Feeds

Flaws leave Cisco content switches vulnerable

Upgrade for DoS bug, but access flaw workaround only

  • alert
  • submit to reddit

Internet Security Threat Report 2014

Cisco has issued a security notice which admits to two security vulnerabilities affecting its range of high-end content switches, one of which remains unfixed.

The firm said that its Cisco Content Services (CSS) switch product, also known as Arrowpoint, has several security flaws once access to the command line interface is granted.

The first problem means a temporary denial of service can be launched against the switch by an unprivileged user, who can input commands that can cause the device to continuously reboot. A separate bug means that a user without administrator privileges can view filenames and file contents.

Among the products affected by the vulnerabilities are Cisco CSS 11050, CSS 11150, and CSS 11800 boxes, which run Cisco WebNS software. No other Cisco products are affected.

These devices are used by very large firms and service providers to manage Internet traffic flowing into web server farms, providing better reliability and resilience by distributing workloads across many servers, which can be a complex process.

Deri Jones, of security testers NTA Monitor, said the issue is potential serious because only companies with deep pockets, and whose Internet presence is vital, would shell out for the Arrowpoint kit, and so "denials of service would almost certainly mean a big loss if they occur.

"The flaw itself, of having users with some level of privilege but not full privilege - but who are found to be able to do more than was intended, is a recurring theme in security problems," he said.

Users can protect themselves against a possible denial of service attack by upgrading to either 4.01(12s), and revision 3.10 (71s) of Cisco WebNS software. Cisco is working on a fix for the authorised access problem, and in the meantime is advising users to apply access control lists or restrict access through the firewall to the device's management interface.

The flaws came to light during a security audit of one of Cisco's customers, but the networking giant has stated that so far it is not aware of any malicious exploitation of the vulnerabilities. ®

External link

Cisco's security notice

Beginner's guide to SSL certificates

More from The Register

next story
Docker's app containers are coming to Windows Server, says Microsoft
MS chases app deployment speeds already enjoyed by Linux devs
'Hmm, why CAN'T I run a water pipe through that rack of media servers?'
Leaving Las Vegas for Armenia kludging and Dubai dune bashing
'Urika': Cray unveils new 1,500-core big data crunching monster
6TB of DRAM, 38TB of SSD flash and 120TB of disk storage
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
SDI wars: WTF is software defined infrastructure?
This time we play for ALL the marbles
Windows 10: Forget Cloudobile, put Security and Privacy First
But - dammit - It would be insane to say 'don't collect, because NSA'
Oracle hires former SAP exec for cloudy push
'We know Larry said cloud was gibberish, and insane, and idiotic, but...'
Symantec backs out of Backup Exec: Plans to can appliance in Jan
Will still provide support to existing customers
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.