Gladiator Research and Security

GSA Reference Number: AD090925-01

Simply Put: Cisco has announced eleven new vulnerabilities in multiple Cisco products.  Nine of the vulnerabilities affect Cisco’s IOS – the operating system for many Cisco devices.  Cisco IOS is present on Cisco routers and switches.  Two more vulnerabilities affect Unified Communications Manager.  The vulnerabilities cover denial of service and authentication bypass on IOS, as well as denial of service and remote code execution on Unified Communications Manager.   Many of these vulnerabilities are considered Critical by Gladiator, since a denial of service on a router would result in loss of Internet access.  Note: Cisco Firewalls do not run Cisco IOS and are not vulnerable to these issues.

Attack Details:

Here is a list of the advisories released by Cisco:

• Cisco Security Advisory: Cisco Unified Communications Manager Express Vulnerability
• Cisco Security Advisory: Cisco IOS Software Internet Key Exchange Resource Exhaustion Vulnerability
• Cisco Security Advisory: Cisco IOS Software Tunnels Vulnerability
• Cisco Security Advisory: Cisco IOS Software Object-group Access Control List Bypass Vulnerability
• Cisco Security Advisory: Cisco Unified Communications Manager Session Initiation Protocol Denial of Service Vulnerability
• Cisco Security Advisory: Cisco IOS Software H.323 Denial of Service Vulnerability
• Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability
• Cisco Security Advisory: Cisco IOS Software Crafted Encryption Packet Denial of Service Vulnerability
• Cisco Security Advisory: Cisco IOS Software Authentication Proxy Vulnerability
• Cisco Security Advisory: Cisco IOS Software Zone-Based Policy Firewall Vulnerability
• Cisco Security Advisory: Cisco IOS Software Network Time Protocol Packet Vulnerability

Countermeasures: Each advisory lists affected products, details and mitigation techniques for those not able to apply the patch right away. Gladiator recommends users contact their network support provider, if applicable, in order to apply the necessary patches.  Remember, back up your routers’ configuration before applying any patches.

Reference Links:

• Cisco Security Advisory Site (http://www.cisco.com/en/US/products/products_security_advisories_listing.html)
• SANS ISC Diary Entry (http://isc.sans.org/diary.html?storyid=7180)