The IKEv2 client and initiator implementations in Cisco IOS 15.5(3)M and IOS XE allow remote IKEv2 servers to cause a denial of service (device reload) via crafted IKEv2 packets, aka Bug ID CSCux97540.
Monthly Archives: October 2016
Cisco Firepower Threat Management Console Denial Of Service
Cisco Firepower Threat Management Console suffers from a denial of service vulnerability. Cisco Fire Linux OS 6.0.1 (build 37/build 1213) is affected.
KL-001-2016-006 : Cisco Firepower Threat Management Console Local File Inclusion
Posted by KoreLogic Disclosures on Oct 05
KL-001-2016-006 : Cisco Firepower Threat Management Console Local File Inclusion
Title: Cisco Firepower Threat Management Console Local File Inclusion
Advisory ID: KL-001-2016-006
Publication Date: 2016.10.05
Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2016-006.txt
1. Vulnerability Details
Affected Vendor: Cisco
Affected Product: Firepower Threat Management Console
Affected Version: Cisco Fire Linux OS…
KL-001-2016-007 : Cisco Firepower Threat Management Console Remote Command Execution Leading to Root Access
Posted by KoreLogic Disclosures on Oct 05
KL-001-2016-007 : Cisco Firepower Threat Management Console Remote Command
Execution Leading to Root Access
Title: Cisco Firepower Threat Management Console Remote Command Execution
Leading to Root Access
Advisory ID: KL-001-2016-007
Publication Date: 2016.10.05
Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2016-007.txt
1. Vulnerability Details
Affected Vendor: Cisco
Affected Product: Firepower Threat…
KL-001-2016-005 : Cisco Firepower Threat Management Console Hard-coded MySQL Credentials
Posted by KoreLogic Disclosures on Oct 05
KL-001-2016-005 : Cisco Firepower Threat Management Console Hard-coded MySQL
Credentials
Title: Cisco Firepower Threat Management Console Hard-coded MySQL Credentials
Advisory ID: KL-001-2016-005
Publication Date: 2016.10.05
Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2016-005.txt
1. Vulnerability Details
Affected Vendor: Cisco
Affected Product: Firepower Threat Management Console
Affected Version:…
KL-001-2016-004 : Cisco Firepower Threat Management Console Authenticated Denial of Service
Posted by KoreLogic Disclosures on Oct 05
KL-001-2016-004 : Cisco Firepower Threat Management Console Authenticated Denial
of Service
Title: Cisco Firepower Threat Management Console Authenticated Denial of Service
Advisory ID: KL-001-2016-004
Publication Date: 2016.10.05
Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2016-004.txt
1. Vulnerability Details
Affected Vendor: Cisco
Affected Product: Firepower Threat Management Console
Affected…
Cisco Security Advisory 20161005-bgp
Cisco Security Advisory – A vulnerability in the Border Gateway Protocol (BGP) implementation of Cisco NX-OS System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to the device unexpectedly reloading. The vulnerability is due to incomplete input validation of the BGP update messages. An attacker could exploit this vulnerability by sending a crafted BGP update message to the targeted device. An exploit could allow the attacker to cause the switch to reload unexpectedly.
HP Security Bulletin HPSBGN03639 1
HP Security Bulletin HPSBGN03639 1 – A potential security vulnerability has been identified in HPE KeyView. The vulnerability could be exploited remotely to allow code execution. Revision 1 of this advisory.
BREAKING! Another NSA Contractor Arrested For Stealing 'Secret' Documents
Another Edward Snowden?
The FBI has secretly busted another National Security Agency (NSA) contractor over a massive secret data theft.
The United States Justice Department charged Harold Thomas Martin, 51, with theft of highly classified government material, including “source codes” developed by the NSA to hack foreign government, according to a court complaint (PDF) unsealed on Wednesday.
Cisco Security Advisory 20161005-dhcp2
Cisco Security Advisory – A vulnerability in the implementation of the DHCPv4 relay agent in Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of malformed DHCPv4 packets. An attacker could exploit this vulnerability by sending malformed DHCPv4 packets to an affected device. An exploit could allow the attacker to cause the DHCP process or device to crash. This vulnerability can be exploited using IPv4 packets only. The vulnerability can be triggered by malformed DHCP packets processed by a DHCP relay agent listening on the device, using the IPv4 broadcast address or IPv4 unicast address of any interface configured on a device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.