Feeds

Flaws leave Cisco content switches vulnerable

Upgrade for DoS bug, but access flaw workaround only

  • alert
  • submit to reddit

Next gen security for virtualised datacentres

Cisco has issued a security notice which admits to two security vulnerabilities affecting its range of high-end content switches, one of which remains unfixed.

The firm said that its Cisco Content Services (CSS) switch product, also known as Arrowpoint, has several security flaws once access to the command line interface is granted.

The first problem means a temporary denial of service can be launched against the switch by an unprivileged user, who can input commands that can cause the device to continuously reboot. A separate bug means that a user without administrator privileges can view filenames and file contents.

Among the products affected by the vulnerabilities are Cisco CSS 11050, CSS 11150, and CSS 11800 boxes, which run Cisco WebNS software. No other Cisco products are affected.

These devices are used by very large firms and service providers to manage Internet traffic flowing into web server farms, providing better reliability and resilience by distributing workloads across many servers, which can be a complex process.

Deri Jones, of security testers NTA Monitor, said the issue is potential serious because only companies with deep pockets, and whose Internet presence is vital, would shell out for the Arrowpoint kit, and so "denials of service would almost certainly mean a big loss if they occur.

"The flaw itself, of having users with some level of privilege but not full privilege - but who are found to be able to do more than was intended, is a recurring theme in security problems," he said.

Users can protect themselves against a possible denial of service attack by upgrading to either 4.01(12s), and revision 3.10 (71s) of Cisco WebNS software. Cisco is working on a fix for the authorised access problem, and in the meantime is advising users to apply access control lists or restrict access through the firewall to the device's management interface.

The flaws came to light during a security audit of one of Cisco's customers, but the networking giant has stated that so far it is not aware of any malicious exploitation of the vulnerabilities. ®

External link

Cisco's security notice

Next gen security for virtualised datacentres

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.