Cisco Systems Inc. on Thursday warned its customers about a serious security vulnerability in the software that controls several of its popular switches. The flaw enables attackers to bypass the password authentication and get control over a vulnerable switch.
The vulnerability is found in the Catalyst OS software version 7.5(1), which runs on Catalyst 4000, 6000 and 6500 series switches. The problem does not affect the Cisco IOS software.
To exploit this flaw, an attacker would need to be able to get command-line access to an affected switch. This could be accomplished in one of several ways, including through the switchs administrative console, Telnet or SSH.
Once at the command line, the attacker need only have a valid username to gain access to the “enable” mode on the switch. As long as local user authentication is enabled, no password is required. Enable mode would allow the attacker to make configuration changes to the switch.
Cisco, based in San Jose, Calif., has released a new version of the Catalyst OS software that fixes the problem. Version 7.6(1) is available through the companys normal upgrade channels.
Also on Thursday, NSFocus Information Technology Ltd., of Beijing, China, said it had found a vulnerability in the Web interface of Ciscos Secure Access Control Server for Windows. The Secure ACS is a framework that supports access control and auditing for dial-in servers, VPNs, firewalls and voice-over-IP solutions.
There is a buffer overflow vulnerability in the CSAdmin program that handles the Web-based management of the Secure ACS. During log-in, the program fails to check the length of the user parameter. An attacker who sent an unusually long user parameter to the server could cause the server to hang or restart, according to the NGSS advisory.
And, in some circumstances, the attacker could execute code on the machine with the privileges of the CSAdmin process. This vulnerability affects versions 2.6.4, 3.0.3 and 3.1.1 of the Secure ACS. Cisco has released patches for the flaw, and fixes will also be included in future versions of the Secure ACS software.
The patches are available here.
Most Recent Security Stories:
Search for more stories by Dennis Fisher.
Find white papers on security.
For more security news, check out Ziff Davis Medias Security Supersite.