Posts Tagged ‘cisco’

Critical RCE Vulnerability Found in Cisco WebEx Extensions, Again — Patch Now!

Wednesday, July 19th, 2017
Cisco-WebEx-Remote-Command-Execution

A highly critical vulnerability has been discovered in the Cisco Systems’ WebEx browser extension for Chrome and Firefox, for the second time in this year, which could allow attackers to remotely execute malicious code on a victim’s computer.

Cisco WebEx is a popular communication tool for online events, including meetings, webinars and video conferences that help users connect and collaborate with colleagues around the world.  The extension has roughly 20 million active users.Discovered by Tavis Ormandy of Google Project Zero and Cris Neckar of Divergent Security, the remote code execution flaw (CVE-2017-6753) is due to a designing defect in the WebEx browser extension. To exploit the vulnerability, all an attacker need to do is trick victims into visiting a web page containing specially crafted malicious code through the browser with affected extension installed.  Successful exploitation of this vulnerability could result in the attacker executing arbitrary code with the privileges of the affected browser and gaining control of the affected system.

“I see several problems with the way sanitization works, and have produced a remote code execution exploit to demonstrate them,” Ormandy said. “This extension has over 20M [million] active Chrome users alone, FireFox and other browsers are likely to be affected as well.”Cisco has already patched the vulnerability and released “Cisco WebEx Extension 1.0.12” update for Chrome and Firefox browsers that address this issue, though “there are no workarounds that address this vulnerability.”

“This vulnerability affects the browser extensions for Cisco WebEx Meetings Server, Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center), and Cisco WebEx Meetings when they are running on Microsoft Windows,” Cisco confirmed in an advisory released today.

Download Cisco WebEx Extension 1.0.12

In general, users are always recommended to run all software as a non-privileged user in an effort to diminish the effects of a successful attack.

 Fortunately, Apple’s Safari, Microsoft’s Internet Explorer and Microsoft’s Edge are not affected by this vulnerability.  Cisco WebEx Productivity Tools, Cisco WebEx browser extensions for Mac or Linux, and Cisco WebEx on Microsoft Edge or Internet Explorer are not affected by the vulnerability, the company confirmed.The remote code execution vulnerability in Cisco WebEx extension has been discovered second time in this year.

 

Source: Critical RCE Vulnerability Found in Cisco WebEx Extensions, Again — Patch Now!

Cisco disrupts $30 million browser plug-in hacking operation

Wednesday, October 7th, 2015

Cisco has disrupted a major browser-based hacking operation, thought to be worth $30 million to criminals each year.

The company said unnamed hackers used the notorious Angler Exploit Kit to take advantage of vulnerabilities in common browser plugins, such as Flash and Java.

As many as 90,000 users were affected each day by the attack.

The networking company, through its security wing Talos Group, patched the vulnerabilities being used by the exploit kit, cutting off affected machines from the command-and-control infrastructure.

“This is a significant blow to the emerging hacker economy where ransomware and the black market sale of stolen [intellectual property, credit card info and personally identifiable information are generating hundreds of millions of dollars annually,” said the researchers in a blog post.

The exploit kit helped to generate vast sums by gaining access to computers, and holding them hostage for a ransom price, which must be paid within a limited time frame to gain back access to their device.

US federal agents warned earlier this year that so-called ransomware, which encrypts files and documents without the owner’s permission, costs consumers $18 million a year.

 

via ZDNet Article

Cisco ASR 1000 Series Aggregation Services Routers Fragmented Packet Denial of Service Vulnerability

Tuesday, August 4th, 2015

Summary: A vulnerability in the code handling the reassembly of fragmented IP version 4 (IPv4) or IP version 6 (IPv6) packets of Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause a crash of the Embedded Services Processor (ESP) processing the packet. The vulnerability is due to improper processing of crafted, fragmented packets. An attacker could exploit this vulnerability by sending a crafted sequence of fragmented packets. An exploit could allow the attacker to cause a reload of the affected platform. Cisco has released software updates that address this vulnerability. There are no workarounds to mitigate this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150730-asr1k

Vulnerable Products: All Cisco ASR 1000 Series Aggregation Services Routers models are affected by this vulnerability when running an affected version of Cisco IOS XE Software. This vulnerability does not depend on any specific combination of ESP and Route Processor (RP) installed on the chassis. Any combination of ESP and RP is affected. Products Confirmed Not Vulnerable

Details: A vulnerability in the code handling the reassembly of fragmented IP version 4 (IPv4) or IP version 6 (IPv6) packets of Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause a crash of the Embedded Services Processor (ESP) processing the packet. The vulnerability is due to improper processing of crafted, fragmented packets. An attacker could exploit this vulnerability by sending a crafted sequence of fragmented packets. An exploit could allow the attacker to cause a reload of the affected platform. This vulnerability can be triggered by IPv4 or IPv6 crafted, fragmented packets destined to the device itself. It cannot be triggered by transit traffic. This vulnerability could be repeatedly exploited to cause an extended DoS condition. This vulnerability is documented in Cisco bug ID CSCtd72617 (registered customers only), and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2015-4291.

Vulnerability Scoring Details Cisco has scored the vulnerability in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this security advisory is in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps organizations determine the urgency and priority of a response. Cisco has provided a base and temporal score. Customers can also compute environmental scores that help determine the impact of the vulnerability in their own networks. Cisco has provided additional information regarding CVSS at the following link: http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html

Cisco has also provided a CVSS calculator to compute the environmental impact for individual networks at the following link: http://intellishield.cisco.com/security/alertmanager/cvss CSCtd72617

– Cisco IOS XE Software Fragmented Packet Denial of Service Vulnerability Calculate the environmental score of CSCtd72617 CVSS Base Score – 7.8 Access Vector Access Complexity Authentication Confidentiality Impact Integrity Impact Availability Impact Network Low None None None Complete CVSS Temporal Score – 6.4 Exploitability Remediation Level Report Confidence Functional Official-Fix Confirmed

Impact

Successful exploitation of this vulnerability may cause a crash of the ESP processing the packet, resulting in a DoS condition. Repeated exploitation could result in an extended DoS condition.

Software Versions and Fixes When considering software upgrades, customers are advised to consult the Cisco Security Advisories, Responses, and Alerts archive at http://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution.

In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. This vulnerability has been fixed in the following Cisco IOS XE Software versions:

Cisco IOS XE Software Train First Fixed Release 2.1 Vulnerable;

migrate to 2.5.1 or later.

(1) 2.2 Vulnerable; migrate to 2.5.1 or later.

(1) 2.3 Vulnerable; migrate to 2.5.1 or later.

(1) 2.4 2.4.3 (1) 2.5 2.5.1 (1)

Source: Cisco ASR 1000 Series Aggregation Services Routers Fragmented Packet Denial of Service Vulnerability

New BlackEnergy Crimeware Enhanced to Target Linux Systems and Cisco Routers

Wednesday, November 5th, 2014

 

BlackEnergy Cyber Crimeware equipped to Target Linux Systems and Cisco Routers

 

Security researchers at Kaspersky Lab have unearthed new capabilities in the BlackEnergy Crimeware weapon that has now ability to hacking routers, Linux systems and Windows, targeting industry through Cisco network devices.The antivirus vendor’s Global Research & Analysis Team released a report Monday detailing some of the new “relatively unknown” custom plug-in capabilities that the cyber espionage group has developed for BlackEnergy to attack Cisco networking devices and target ARM and MIPS platforms.The malware was upgraded with custom plugins including Ciscoapi.tcl which targets The Borg’s kit, and According to researchers, the upgraded version contained various wrappers over Cisco EXEC-commands and “a punchy message for Kaspersky,” which reads, “Fuck U, Kaspersky!!! U never get a fresh B1ack En3rgy. So, thanks C1sco 1td for built-in backd00rs & 0-days.”BlackEnergy malware program was originally created and used by cybercriminals to launch Distributed Denial-of-Service DDoS attacks. The malware developer then added some custom plugins used to funnel banking information.Most recently BlackEnergy malware was observed in alleged state-sponsored attacks targeting the North Atlantic Treaty Organization NATO, Ukrainian and Polish government agencies, and a variety of sensitive European industries over the last year.Now, the cyber espionage group has enhanced the malware program which also has the capabilities like port scanning, password stealing, system information gathering, digital certificate theft, remote desktop connectivity and even hard disk wiping and destroying.In case if a victim knew of the BlackEnergy infection on their system, the attacker activates “dstr,” the name of a plugin that destroys hard disks by overwriting them with random data. A second victim was compromised by using VPN credentials taken from the first victim.Security researchers, Kurt Baumgartner and Maria Garnaeva, also came across BlackEnergy version that works on ARM and MIPS based systems and found that it has compromised networking devices manufactured by Cisco Systems.However, the experts are not sure for the purpose of some plugins, including one that gathers device instance IDs and other information on connected USB drives and another that collects details on the BIOS Basic Input/Output System, motherboard, and processor of infected systems. “We are pretty sure that our list of [BlackEnergy] tools is not complete,” the researchers wrote. “For example, we have yet to obtain the router access plugin, but we are confident that it exists. Evidence also supports the hypothesis that there is a decryption plugin for victim files.”Multiple unnamed victim companies in different countries were targeted with the latest BlackEnergy malware, including victims in Russia, Germany, Belgium, Turkey, Libya, Vietnam and several other countries.Another Crimeware group, the Sandworm Team, believed to have used the BlackEnergy exclusively throughout 2014 at victim sites and included custom plugin and scripts of their own. Also last month, the Sandworm Team had targeted organizations across the world in an espionage campaign, and iSIGHT Partners revealed that the team used spear phishing as the major attack vector to victimize their targets.

via New BlackEnergy Crimeware Enhanced to Target Linux Systems and Cisco Routers.

Multiple Cisco Wireless Gateways Vulnerable to Remote Attacks

Monday, July 21st, 2014

ultiple Cisco Wireless Residential Gateway products have a security vulnerability in the web server that could allow a remote attacker to hijack the devices remotely.

Cisco announced that a number of its Wireless Residential Gateway products are vulnerable to a remote-code execution attack, which is exploited by sending a specially crafted HTTP request to the web server running on the affected device.

According to Cisco, the flaw is due to the incorrect input validation for HTTP requests, which could allow an attacker to exploit a buffer overflow and run arbitrary code on the device. The bug is about as serious as they come, giving remote, unauthenticated attackers access to the affected machines.

“Successful exploitation of the vulnerability may cause the embedded web server to crash and allow the attacker to inject arbitrary commands and execute arbitrary code with elevated privileges,” the Cisco advisory says, and until now, “There are currently no known workarounds available for this vulnerability.”

The Cisco products affected by the vulnerability are as follows:

Cisco DPC3212 VoIP Cable Modem

Cisco DPC3825 8×4 DOCSIS 3.0 Wireless Residential Gateway

Cisco EPC3212 VoIP Cable Modem

Cisco EPC3825 8×4 DOCSIS 3.0 Wireless Residential Gateway

Cisco Model DPC3010 DOCSIS 3.0 8×4 Cable Modem

Cisco Model DPC3925 8×4 DOCSIS 3.0 with Wireless Residential Gateway with EDVA

Cisco Model DPQ3925 8×4 DOCSIS 3.0 Wireless Residential Gateway with EDVA

Cisco Model EPC3010 DOCSIS 3.0 Cable Modem

Cisco Model EPC3925 8×4 DOCSIS 3.0 with Wireless Residential Gateway with EDVA

Cisco said the security bug exists in the devices whether they are configured in a Gateway mode or Router mode on home or small office gateways.

Cisco uses the Common Vulnerability Scoring System (CVSS) to provide an open and standardized rating of the security holes it finds in its products. This vulnerability received a most critical rating according to its CVSS i.e. base score 10. The vulnerability was reported by Chris Watts of Tech Analysis to Cisco.

Cisco has released and distributed free software updates to its service provider customers that address the vulnerability, the service providers would further pass-on to the affected home and small office customers. The customers are advised to contact their service providers to confirm the software deployed by the service provider includes the fix.

via Multiple Cisco Wireless Gateways Vulnerable to Remote Attacks.