Print
Discuss
Send to friend
RSS feedsCisco Systems is warning enterprise users of several recently discovered and patched security flaws.
The first exists in the company's Access Control Server (ACS). If exploited, the vulnerability could allow an attacker to crash the server, leading to a denial-of-service attack.
The flaw is believed to exist in all current versions of ACS for Windows and Cisco Secure ACS Solution Engine.
The company has issued a patch and is advising network administrators to apply the update.
Cisco said that the vulnerability exists in the handling of Remote Access Dial-In User Service (Radius) communications.
An attacker could exploit the vulnerability by way of a specially-crafted Radius authentication data packet sent to the server.
The company noted that, in order for the exploit to be carried out, the attacker must know the IP address of the target server as well as the Radius Shared Secret.
Discovery of the issue was credited to researchers Laurent Butti and Gabriel Campana.
Cisco also warned of six flaws in its ASA 5500 adaptive security and Pix security appliances.
The vulnerabilities include five denial-of-service flaws and one which could lead to information disclosure.
The company is advising its users to apply the latest updates for both appliances in order to protect against attack.
See also:
Is network giant looking to compete with Microsoft via purchase of email provider PostPath? 28 Aug 2008
'Rogue employee' refuses to divulge passwords 17 Jul 2008
Optical infrastructure enables transmission of 100GE over DWDM network 30 Jun 2008
Company looking at India, China and the Middle East 26 Jun 2008All Network Infrastructure Tags: Cisco, Hardware, Management, Security
del.icio.us
Digg this
reddit!
