Preface: Cisco has released patches for its networking appliance users and customers in order to address a number of security flaws. The vulnerabilities could allow attackers to inject commands and crash critical services.
Cisco networking giant released security patches for its email, Web, and content security appliances in order to address vulnerabilities that could allow attackers to execute commands on the underlying OS or disrupt critical processes.
The vulnerabilities affect different versions of the Cisco IronPort AsyncOS operating system that’s used in the Cisco Content Security Management Appliance, the Cisco Email Security Appliance and the Cisco Web Security Appliance.
Three vulnerabilities can now be fixed that relate to the Cisco Email Security Appliance with software versions 7.1 and older, 7.3, 7.5 and 7.6. One flaw allowed a remote code injection that allowed the execution of commands with elevated privileges. Another could cause critical processes to crash and become unresponsive, while the third could cause a denial of service condition by exploiting the user interface.
Exploiting the command injection vulnerability requires authentication via the Web interface with at least a low privilege account, but the denial-of-service vulnerabilities can be exploited remotely without authentication.
Users of the 7.1 branch should upgrade to version 7.1.5-016 or later, users of the 7.3 branch should upgrade to version 8.0.0-671 and users of the 7.5 and 7.6 branches should upgrade to 7.6.3-019 or later, Cisco said in a security advisory published Wednesday. Releases in the 8.0 branch are not affected.
Branches 7.2 and prior, 7.7, 7.8, 7.9 and 8.0 of the Cisco Content Security Management Appliance software are affected by the same command injection and denial-of-service vulnerabilities as the Cisco Email Security Appliance software.
All of the vulnerabilities are patched in versions 7.9.1-102 and 8.0.0-404, Cisco said in a separate advisory. Users of 7.2 and prior, 7.7 and 7.8 branches are advised to upgrade to version 7.9.1-102 or later of the software. The 8.1 versions are not affected.
Releases 7.1 and prior, 7.5 and 7.7 of the Cisco Web Security Appliance software are vulnerable to two authenticated command injection vulnerabilities and one management GUI denial-of-service vulnerability. Some of the vulnerabilities are the same as those affecting the Cisco Email Security Appliance software.
The software releases that include fixes for all three Cisco Email Security Appliance vulnerabilities are 7.5.1-201 and 7.7.0-602. Users of the 7.1 and prior versions are advised to upgrade to 7.5.1-201 or later.
News reference from Infoworld.com
More Cisco News:
Cisco Chambers: “IoE is the Next Big Transition for Businesses”
Cisco to Acquire Composite Software for $180 Million
Cisco Delivers “Monster” Catalyst Switch, Routers for SDN Environments
