Indian cyber agency finds multiple bugs in Cisco products


New Delhi, April 27 (IANS): The Indian Computer Emergency Response Team (CERT-In) which comes under the Ministry of Electronics & Information Technology, has issued an advisory over three serious vulnerabilities in networking giant Cisco products that could allow hackers to gain access, infiltrate into computer systems and steal data.

The vulnerabilities reported in Cisco Adaptive Security Appliance (ASA) software and Cisco Firepower Threat Defense (FTD) software could allow attackers to execute arbitrary commands and code on the underlying operating system with root-level privileges, device to reload unexpectedly, resulting in a denial of service (DoS), CERT-In said in its latest advisory.

The 'Command Injection Vulnerability' exists in the reported software due to the contents of a backup file being improperly sanitised at restore time.

"An attacker could exploit this vulnerability by restoring a crafted backup file to an affected device," the cyber agency said.

Another 'Denial of Service Vulnerability' exists due to incomplete error checking when parsing an HTTP header.

Attackers could use this vulnerability by "sending a crafted HTTP request to a targeted web server on a device" and the successful exploitation could allow them to cause a "DoS condition when the device reloads".

The third, 'Code Execution Vulnerability' exists due to improper validation of a file when it is read from system flash memory.

According to the cyber agency, an attacker could exploit this vulnerability by copying a "crafted file to the disk0: file system of an affected device".

In addition, CERT-In advised people to apply appropriate updates as released by Cisco.

 

  

Top Stories


Leave a Comment

Title: Indian cyber agency finds multiple bugs in Cisco products



You have 2000 characters left.

Disclaimer:

Please write your correct name and email address. Kindly do not post any personal, abusive, defamatory, infringing, obscene, indecent, discriminatory or unlawful or similar comments. Daijiworld.com will not be responsible for any defamatory message posted under this article.

Please note that sending false messages to insult, defame, intimidate, mislead or deceive people or to intentionally cause public disorder is punishable under law. It is obligatory on Daijiworld to provide the IP address and other details of senders of such comments, to the authority concerned upon request.

Hence, sending offensive comments using daijiworld will be purely at your own risk, and in no way will Daijiworld.com be held responsible.