Cisco on Wednesday said it has fixed a pair of vulnerabilities in IOS, the software that runs the majority of its routers and switches.
The flaws affect the IOS FTP Server feature and, if exploited, could give remote attackers the ability to bypass authentication, get their hands on passwords from device file systems or launch malicious code attacks, Cisco said in an advisory.
The more serious of the vulnerabilities has to do with the failure of IOS to properly verify user credentials, which could allow miscreants to gain unauthorized access to devices and boost their privileges, said Cisco, which assigned the maximum CVSS base score of 10 to the flaw.
The second IOS FTP Server bug is triggered when files are being transferred through the device by FTP, which could give attackers a means of launching denial-of-service attacks. Cisco assigned a CVSS base score of 2 to this vulnerability.
IOS versions 11.3, 12.0, 12.1, 12.2, 12.3 and 12.4 include the IOS FTP Server, but the overall impact of the vulnerabilities is mitigated somewhat by the fact that the feature isn't enabled by default, Cisco noted.
San Jose, Calif.-based Cisco has released a fix that disables the IOS FTP server feature, which can also be done by issuing the command "no ftp-server enable" while in configuration mode.
Danish security research firm Secunia rated the vulnerabilities as "moderately critical," or 3 on a 5-point scale, while Symantec Deepsight weighed in with a severity score of 7.9 on its own proprietary rating scale.
|
Symantec's Code Red: The Law Enforcement/Anonymous E-Mail Exchange Law enforcement officials negotiated via e-mail for more than two weeks with an Anonymous group member trying to extort $50,000 from Symantec to keep stolen product code off the Internet. |
|
How To Sell IT Security Services To Your Customers Cyberattacks can cost a business thousands, even millions, of dollars, and can deal a death blow to some. Here's how IT solution providers can help guard against malicious attacks. |
|
Cybersecurity Experts: What They Know Could Scare You A recent report based on interviews with security experts in government, business and academia finds more than half in agreement that a worldwide arms race is taking place in cyberspace. |
 More
Slide Shows |
- Insider Threats: The Next Frontier for Security Resellers and SMBs
- Complete Security and Your Bottom Line: Sophos, Value and the Channel
- Tough Threats, Tougher Security: How You Can Leverage New Solutions To Combat A “Targeted Attack” Landscape
- Dark Clouds Ahead: Why the Mid-Market Needs To Ramp Up Cloud Security and How You Can Help Them Get There
