Security Bytes: Cisco addresses multiple vulnerabilities

By Edmund X. DeJesus, Contributor 20 Apr 2006 | SearchSecurity.com

Security Wire Daily News Digg This!     StumbleUpon     Del.icio.us

Cisco addresses multiple vulnerabilities
Cisco Systems Inc. has reported multiple vulnerabilities in several of its networking products. Although considered less critical, malicious individuals could exploit these vulnerabilities for cross-site scripting, privilege escalation, or denial of service from local or remote systems. Cisco has provided fixes for most of the issues, except for several end-of-life products that it no longer supports.

The first vulnerabilities occur in CiscoWorks Wireless LAN Solution Engine (WLSE) 2.x. A vulnerability in the WLSE appliance Web interface "can be exploited to execute arbitrary HTML and script code in a user's browser session," according to an advisory posted by Danish vulnerability clearing house Secunia.

Another vulnerability, in a CLI application, can be exploited to gain a shell account with root privileges. Malicious users can perform these actions remotely. Cisco suggests updating to version 2.13 or later.

The second group of vulnerabilities is in Cisco IOS XR. All three vulnerabilities involve processing Multiprotocol Label Switching (MPLS) packets. Malicious users can exploit this locally to cause a denial of service. Cisco has patched the issue.

The final vulnerability affects Cisco Ethernet Subscriber Solution Engine (ESSE), CiscoWorks2000 Service Management Solution (SMS), Cisco Wireless LAN Solution Engine (WLSE), Cisco Hosting Solution Engine (HSE), and Cisco User Registration Tool (URT). According to Secunia, malicious local users can exploit the vulnerability to gain escalated privileges. Cisco has fixes for Cisco WLSE, Cisco HSE, and Cisco URT. However, Cisco ESSE and CiscoWorks SMS are end-of-life products and Cisco will not provide fixes, according to its advisory.

Apple fixes five Java vulnerabilities
Apple has released a patch for five Java-related vulnerabilities in the Mac OS X operating system (http://www.frsirt.com/english/advisories/2006/1398). According to an advisory by the French Security Incident Response Team (FrSIRT), a widely known vulnerability clearinghouse, at least one of these vulnerabilities is regarded as critical: malicious users could exploit it to remotely compromise a system. The problem is known to affect Mac OS X v10.4.5 and Mac OS X Server v10.4.5. However, a Sun Microsystems Inc. advisory admits that Microsoft Windows, Sun Solaris, and Linux systems may also be vulnerable.

More specifically, Sun's Java Web Start software contains a flaw that can allow untrusted applications to elevate their own privileges, including reading and writing arbitrary local files. Sun describes Java Web Start as technology that makes full-featured applications available via Web server. A specially crafted application could circumvent security restrictions and allow access and control by intruders. The flaw is in Java 2 Platform Standard Edition (J2SE) 5.0 Update 5 and earlier 5.0 releases.

In addition, several vulnerabilities in the Java Runtime Environment can permit untrusted applets to elevate their own privileges. This could also allow attackers to evade security and gain control of an affected system.

Finally, an issue with event handling can, for example, cause secure fields -- such as passwords -- to appear as normal text in the same window.

Sun first disclosed the vulnerabilities on Feb. 7. Customers are advised to upgrade to the Java 2 Standard Edition 5.0 Release 4 update (J2SE version 1.5.0_06).

F-Secure discovers first J2ME Trojan
Helsinki-based F-Secure Corp. has discovered Redbrowser.A, which it believes to be the first Trojan in J2ME form. Java 2 Micro Edition provides an environment for applications running on millions of consumer devices, such as mobile phones and PDAs.

A J2ME-based Java midlet, Redbrowser masquerades as a WAP browser, using free SMS messages to send the WAP pages. Redbrowser's claim to send free SMS messages is intended to fool a user into permitting the application to use Java SMS capabilities. When given permission, Redbrowser actually starts sending SMS messages to one specific number in an infinite loop. Each message is charged to the user's account, which may cause financial losses to the user.

Redbrowser's text is in Russian, which F-Secure said should limit the Trojan to Russian-speaking countries.

In addition to using its own removal tools, F-Secure said users can eradicate the Trojan by uninstalling it with the Symbian application manager.

Edmund X. DeJesus is a freelance writer in Norwood, Mass.

Tags: Emerging Information Security Threats,  Wireless Network Protocols and Standards,  Web Server Threats and Countermeasures,  VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Emerging Information Security Threats Best practices for (small) botnets Cybersecurity grant to fund research into critical infrastructure threats RSA security conference 2010: news, interviews and updates Hackers to sharpen malware, malicious software in 2010 Modern malware, stealthy botnets, adapt quickly, expert says New ransomware Trojan pushes victims to buy software Bruce Schneier on outsourcing, awareness training Marcus Ranum on cyberwarfare, infosec careers US-CERT warns of BlackBerry snooping software Researchers find thousands of flawed embedded devices Wireless Network Protocols and Standards Wireless network guidelines for PCI DSS compliance Best Wireless Security Products MMS messaging spoof hack could have global ramifications PCI group releases wireless security guide 802.1X Port Access Control: Which version is best for you? Wireless Security Lunchtime Learning An introduction to wireless security Lesson 1: How to counter wireless threats and vulnerabilities Risky Business: Understanding WiFi threats Lesson 1 quiz: Risky business Web Server Threats and Countermeasures Increase in Gumblar backdoors poses FTP credential problems VeriSign extends DDoS attack protection service Microsoft issues IIS FTP advisory, exploit code circulates Panda reports fast-spreading rogueware antivirus fraud rakes in millions Oracle issues quarterly patches, fixes database flaws Latest DDoS attacks extremely unsophisticated, experts say Stolen FTP credentials likely in massive website attacks Microsoft warns of IIS zero-day vulnerability How to find and stop automated SQL injection attacks How to spot attacks through Apache Web server log analysis

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary DNS rebinding attack  (SearchSecurity.com) drive-by pharming  (SearchSecurity.com) JavaScript hijacking  (SearchSecurity.com) man in the browser  (SearchSecurity.com) phlashing  (SearchSecurity.com) polymorphic malware  (SearchSecurity.com) pulsing zombie  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary