Feeds

Flaws leave Cisco content switches vulnerable

Upgrade for DoS bug, but access flaw workaround only

  • alert
  • submit to reddit

Next gen security for virtualised datacentres

Cisco has issued a security notice which admits to two security vulnerabilities affecting its range of high-end content switches, one of which remains unfixed.

The firm said that its Cisco Content Services (CSS) switch product, also known as Arrowpoint, has several security flaws once access to the command line interface is granted.

The first problem means a temporary denial of service can be launched against the switch by an unprivileged user, who can input commands that can cause the device to continuously reboot. A separate bug means that a user without administrator privileges can view filenames and file contents.

Among the products affected by the vulnerabilities are Cisco CSS 11050, CSS 11150, and CSS 11800 boxes, which run Cisco WebNS software. No other Cisco products are affected.

These devices are used by very large firms and service providers to manage Internet traffic flowing into web server farms, providing better reliability and resilience by distributing workloads across many servers, which can be a complex process.

Deri Jones, of security testers NTA Monitor, said the issue is potential serious because only companies with deep pockets, and whose Internet presence is vital, would shell out for the Arrowpoint kit, and so "denials of service would almost certainly mean a big loss if they occur.

"The flaw itself, of having users with some level of privilege but not full privilege - but who are found to be able to do more than was intended, is a recurring theme in security problems," he said.

Users can protect themselves against a possible denial of service attack by upgrading to either 4.01(12s), and revision 3.10 (71s) of Cisco WebNS software. Cisco is working on a fix for the authorised access problem, and in the meantime is advising users to apply access control lists or restrict access through the firewall to the device's management interface.

The flaws came to light during a security audit of one of Cisco's customers, but the networking giant has stated that so far it is not aware of any malicious exploitation of the vulnerabilities. ®

External link

Cisco's security notice

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
The Return of BSOD: Does ANYONE trust Microsoft patches?
Sysadmins, you're either fighting fires or seen as incompetents now
Microsoft: Azure isn't ready for biz-critical apps … yet
Microsoft will move its own IT to the cloud to avoid $200m server bill
Shoot-em-up: Sony Online Entertainment hit by 'large scale DDoS attack'
Games disrupted as firm struggles to control network
Cutting cancer rates: Data, models and a happy ending?
How surgery might be making cancer prognoses worse
Silicon Valley jolted by magnitude 6.1 quake – its biggest in 25 years
Did the earth move for you at VMworld – oh, OK. It just did. A lot
Forrester says it's time to give up on physical storage arrays
The physical/virtual storage tipping point may just have arrived
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?