Cisco Flaws Leave Firewalls, VPNs Vulnerable

Network routing and switching giant Cisco Systems has issued an alert for a potentially serious security flaw affecting multiple firewall products, warning that the bug could cause passwords to be changed without any user interaction.

The San Jose, Calif., company said unauthorized users can take advantage of the firewall bug to try to gain access to a device that has been reloaded after passwords in its startup configuration have been changed.

In addition, authorized users can be locked out and lose the ability to manage the affected device, according to the published advisory.

Affected products include Cisco PIX 500 Series Security Appliances, the Cisco ASA 5500 Series Adaptive Security Appliances and the FWSM (Firewall Services Module) for the Cisco Catalyst 6500 switches.

Read here about a recent patch for a Cisco IOS vulnerability.

Cisco 7600 Series routers are impacted if they are running an affected software version, the company said.

"The software issue may cause the EXEC password, password of locally defined users, and the enable password in the startup configuration to change without users intervention. This will prevent administrators from logging in to the device if authentication is configured to use the passwords stored in the startup configuration," Cisco warned.

The company also posted patches for a pair of vulnerabilities in the Cisco VPN 3000 series concentrators when file management via FTP (File Transfer Protocol) is enabled.

The Cisco VPN 3000 series concentrators are a family of remote access VPN (virtual private network) platforms for data encryption and authentication.

In a separate alert, Cisco said the flaws could allow authenticated or unauthenticated attackers to execute certain FTP commands and delete files on the concentrator.

Vulnerable products are the Cisco VPN 3000 series concentrators 3005, 3015, 3020, 3030, 3060 and 3080.

Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.