Menu
Cisco patches serious flaws in router and conferencing server software

Cisco patches serious flaws in router and conferencing server software

The patches fix flaws in Cisco IOS, IOS XR, ASR 5000, WebEx Meetings Server and Cisco Meeting Server

Cisco Systems released patches this week for several vulnerabilities in its IOS software for networking devices and the Cisco and WebEx conferencing servers.

The most serious vulnerability affects the Cisco IOS XR software for the Cisco Network Convergence System (NCS) 6000 Series Routers. It can lead to a denial-of-service condition, leaving affected devices in a nonoperational state.

Unauthenticated, remote attackers can exploit the vulnerability by initiating a number of management connections to an affected device over the Secure Shell (SSH), Secure Copy Protocol (SCP) or Secure FTP (SFTP).

Because it can affect the availability of a critical piece of equipment, like a router, Cisco has rated this vulnerability as high severity. There is no workaround and customers are advised to install the newly released patches.

Another flaw fixed in the Cisco IOS XR software could allow attackers to execute arbitrary commands on the operating system with root privileges. This vulnerability affects IOS XR Software Release 6.0.1.BASE and was rated medium severity because the attacker needs to be authenticated as a local user.

A denial-of-service vulnerability was also fixed in the Cisco IOS Software. It can be used to crash devices running affected versions of the software by sending specially crafted Link Layer Discovery Protocol (LLDP) packets to them. Exploitation doesn't require authentication, but requires the attacker to be in a position to send LLDP packets.

The firmware of Cisco ASR 5000 Series carrier-class platform which is used in 3G and LTE networks, received an update that fixes an insecure SNMP (Simple Network Management Protocol) implementation. The weakness would have allowed attackers to read and modify the device configuration.

Cisco's meeting servers were also the focus of this week's patch releases. One vulnerability in the HTTP interface of the Cisco Meeting Server, formerly Acano Conferencing Server, could have allowed attackers to launch persistent cross-site scripting (XSS) attacks against users of the interface.

Attackers could exploit this flaw by tricking users to click on maliciously crafted links and could then execute rogue JavaScript code in their browsers in the context of the Cisco Meeting Server interface. This could be used to steal authentication cookies or to force them to perform unauthorized actions.

Two XSS vulnerabilities were also fixed in the Cisco WebEx Meetings Server version 2.6, one in its administration interface and one in the user interface. Both could be exploited by tricking users to visit specially crafted links and could lead to further attacks.

The Cisco WebEx Meetings Server also received patches for an SQL injection vulnerability that could allow attackers to extract information from its database and for a command injection flaw.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

Meet the leading female front runners of the Kiwi channel

Meet the leading female front runners of the Kiwi channel

Reseller News honoured the leading female front runners of the New Zealand channel at the 2018 Women in ICT Awards (WIICTA) in Auckland. The awards honoured standout individuals across seven categories, spanning Entrepreneur; Innovation; Rising Star; Shining Star; Community; Technical and Achievement.

Meet the leading female front runners of the Kiwi channel
Meet the top performing customer-centric Microsoft channel partners

Meet the top performing customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the top performing customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments