Feeds

Flaws leave Cisco content switches vulnerable

Upgrade for DoS bug, but access flaw workaround only

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

Cisco has issued a security notice which admits to two security vulnerabilities affecting its range of high-end content switches, one of which remains unfixed.

The firm said that its Cisco Content Services (CSS) switch product, also known as Arrowpoint, has several security flaws once access to the command line interface is granted.

The first problem means a temporary denial of service can be launched against the switch by an unprivileged user, who can input commands that can cause the device to continuously reboot. A separate bug means that a user without administrator privileges can view filenames and file contents.

Among the products affected by the vulnerabilities are Cisco CSS 11050, CSS 11150, and CSS 11800 boxes, which run Cisco WebNS software. No other Cisco products are affected.

These devices are used by very large firms and service providers to manage Internet traffic flowing into web server farms, providing better reliability and resilience by distributing workloads across many servers, which can be a complex process.

Deri Jones, of security testers NTA Monitor, said the issue is potential serious because only companies with deep pockets, and whose Internet presence is vital, would shell out for the Arrowpoint kit, and so "denials of service would almost certainly mean a big loss if they occur.

"The flaw itself, of having users with some level of privilege but not full privilege - but who are found to be able to do more than was intended, is a recurring theme in security problems," he said.

Users can protect themselves against a possible denial of service attack by upgrading to either 4.01(12s), and revision 3.10 (71s) of Cisco WebNS software. Cisco is working on a fix for the authorised access problem, and in the meantime is advising users to apply access control lists or restrict access through the firewall to the device's management interface.

The flaws came to light during a security audit of one of Cisco's customers, but the networking giant has stated that so far it is not aware of any malicious exploitation of the vulnerabilities. ®

External link

Cisco's security notice

New hybrid storage solutions

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.