Cisco patches serious flaws in router and conferencing server software

Cisco Systems released patches this week for several vulnerabilities in its IOS software for networking devices and the Cisco and WebEx conferencing servers.

The most serious vulnerability affects the Cisco IOS XR software for the Cisco Network Convergence System (NCS) 6000 Series Routers. It can lead to a denial-of-service condition, leaving affected devices in a nonoperational state.

Unauthenticated, remote attackers can exploit the vulnerability by initiating a number of management connections to an affected device over the Secure Shell (SSH), Secure Copy Protocol (SCP) or Secure FTP (SFTP).

Because it can affect the availability of a critical piece of equipment, like a router, Cisco has rated this vulnerability as high severity. There is no workaround and customers are advised to install the newly released patches.

Another flaw fixed in the Cisco IOS XR software could allow attackers to execute arbitrary commands on the operating system with root privileges. This vulnerability affects IOS XR Software Release 6.0.1.BASE and was rated medium severity because the attacker needs to be authenticated as a local user.

A denial-of-service vulnerability was also fixed in the Cisco IOS Software. It can be used to crash devices running affected versions of the software by sending specially crafted Link Layer Discovery Protocol (LLDP) packets to them. Exploitation doesn’t require authentication, but requires the attacker to be in a position to send LLDP packets.

The firmware of Cisco ASR 5000 Series carrier-class platform which is used in 3G and LTE networks, received an update that fixes an insecure SNMP (Simple Network Management Protocol) implementation. The weakness would have allowed attackers to read and modify the device configuration.

Cisco’s meeting servers were also the focus of this week’s patch releases. One vulnerability in the HTTP interface of the Cisco Meeting Server, formerly Acano Conferencing Server, could have allowed attackers to launch persistent cross-site scripting (XSS) attacks against users of the interface.

Attackers could exploit this flaw by tricking users to click on maliciously crafted links and could then execute rogue JavaScript code in their browsers in the context of the Cisco Meeting Server interface. This could be used to steal authentication cookies or to force them to perform unauthorized actions.

Two XSS vulnerabilities were also fixed in the Cisco WebEx Meetings Server version 2.6, one in its administration interface and one in the user interface. Both could be exploited by tricking users to visit specially crafted links and could lead to further attacks.

The Cisco WebEx Meetings Server also received patches for an SQL injection vulnerability that could allow attackers to extract information from its database and for a command injection flaw.