Posts

NX-OS-hit! Got Cisco Nexus and MDS 9000 switches? Then you’ve got patching to do, too

/0 Comments/in /by

Oof. Crop of vulns include remote code execution as root

Cisco has published patches for a plethora of problems with its products, including vulns that could trigger denial-of-service conditions – and a sneaky one that “could allow an authenticated, remote attacker to execute arbitrary commands with root privileges”.

The root vuln exists in the NX-API feature of Cisco’s NX-OS switch operating system and comes about because NX-API does not correctly validate user-inputted data.

According to Cisco: “An attacker could exploit this vulnerability by sending malicious HTTP or HTTPS packets to the management interface of an affected system that has the NX-API feature enabled.” These packets are seemingly not authenticated, allowing a random person to gain full control over the target device.

NX-API is disabled by default. The vuln affects a large number of Cisco’s Nexus (n)000 series switches as well as the MDS 9000 Series. Although the vuln has been allocated a CVE number (2019-1614), no further details of the exploit are publicly available at the time of writing. Patches are available from the Cisco website.

D’ohS

Another NX-OS vuln disclosed by Switchzilla today exists in the OS’s network stack. It allows a miscreant to trigger a denial-of-service condition by crapflooding switches running NX-OS with “crafted TCP streams” in a “sustained” way. This causes the stack to “run out of available buffers”, in Cisco’s words, eventually overwhelming the switch and causing it to go and curl up in the corner for a while, gently rocking and murmuring to itself about load balancing.

NX-OS has also been patched for a second DoS trigger, this time one that exists in Cisco’s implementation of LDAP in both NX-OS and Cisco FXOS. Improper parsing of LDAP packets causes a condition that could be exploited by an attacker who has the IP address “of an LDAP server configured on the targeted device”. A successful exploit causes the target device to reboot, triggering a temporary DoS condition. Patches are available here.

Cisco’s full set of patches issued this week for NX-OS and FXOS devices are all available on its website. Last year a slightly more critical set of NX-OS and FXOS were pushed out in June. Happy installing!

Cisco Network Assurance Engine (NAE) contains password vulnerability

/0 Comments/in /by

A default password vulnerability in Network Assurance Engine (NAE) could allow an unauthenticated, local attacker to gain unauthorized access or cause a Denial of Service (DoS) condition on the server.

A flaw in NAE’s password management system can be exploited by authenticating with the default administrator password via the CLI of an affected server. Version 3.0.(1) is vulnerable to the flaw, according to a Feb. 12 security advisory.

Cisco has released an update to address the vulnerability and offers the work around of allowing users to change the default administrator password from the CLI by setting a new password with the passwd command.

Those wishing to use the workaround are instructed to contact Cisco Technical Assistance Center (TAC) so the default password can be entered securely over a remote support session.

Cisco Network Assurance Engine (NAE) contains password vulnerability

/0 Comments/in /by

A default password vulnerability in Network Assurance Engine (NAE) could allow an unauthenticated, local attacker to gain unauthorized access or cause a Denial of Service (DoS) condition on the server.

A flaw in NAE’s password management system can be exploited by authenticating with the default administrator password via the CLI of an affected server. Version 3.0.(1) is vulnerable to the flaw, according to a Feb. 12 security advisory.

Cisco has released an update to address the vulnerability and offers the work around of allowing users to change the default administrator password from the CLI by setting a new password with the passwd command.

Those wishing to use the workaround are instructed to contact Cisco Technical Assistance Center (TAC) so the default password can be entered securely over a remote support session.

A bulletproof vest for your data to wear through the clouds

/0 Comments/in /by

sco Application Centric Infrastructure leaves hardware behind.

Cisco has extended the scope of its latest Application Centric Infrastructure (ACI) to cloud-deployed workloads, in a move that delivers the benefits of ACI beyond Cisco Nexus switching hardware.

The move is in response to deep shifts in how data is stored and used, and how applications are deployed, says Roland Acra, who runs the data center business unit at Cisco. Firms used to keep their data and systems in in-house data centers, he says.

But now there isa growing trend for data to be handled by applications outside of standard data centers, at places such as the network edge or in the cloud.

While a tremendous opportunity for the business, this move can present a problem because it is harder to make sure data and applications are safe and sound if they are being handled outside of a secure in-house setting. In the old days, says Acra, IT heads could use hardware for a “fortress approach” to look after data.

An era in which data is spread across many platforms, though, demands an approach more akin to giving data “a Kevlar helmet and jacket,” he says, in reference to enabling mobility of data and workloads while maintaining security and protection from a single tool.

That is why Cisco has continued to innovate with ACI. It was built to handle network tasks in Cisco hardware-based data centers. And now it has been revamped to run as a software-only package on any platform.

See also: Live EMEA ’19: What you need to know

That includes third-party hardware used in Amazon Web Services and Microsoft Azure clouds. The new version of ACI, called ACI Anywhere, works by taking care of thousands of cloud API commands to rebuild or extend an in-house data center setting inside the cloud.

 

In one demo, spanning clouds across Australia, Europe, and the United States, ACI Anywhere reduced around 3,300 setup commands to just several clicks, Acra says.

A big bonus with the concept is that it cuts the amount of cloud know-how that firms need to have in-house. In one demo, spanning clouds across Australia, Europe, and the United States, ACI Anywhere reduced around 3,300 setup commands to just several clicks, Acra says.

 

Thanks to this, IT bosses can now use clouds without having to hire teams of cloud experts. This ensures compliance with policies from a single tool that extends from their data centers to their enterprise edge and multiple public clouds.

On premise, ACI Anywhere can also manage workflows on virtual platforms such as VMware’s vSphere, Microsoft’s Hyper-V, and OpenStack, or containers built using tools such as Docker, Kubernetes, and OpenShift.

The upgrade means firms can deploy ACI beyond the footprint of Cisco Nexus® 9000 Seriesswitches.“We’re proving that ACI’s value goes beyond Nexus platforms,” says Acra.

Cisco has also brought in new compute and orchestration platforms for data spread across many platforms. Cisco® HyperFlex has been slimmed down to fit into local branches while being cloud-managed by Cisco’s Intersight software. And Cisco CloudCenter has three new modules to help with workflows across a number of clouds.

See also: The Cisco Data Center goes anywhere your data goes

These upgrades were made public at the 2019 Cisco Live event in Barcelona, Spain. At the same time, Cisco has launched an enterprise contract with data centers in mind. The deal gives clients access to a range of data center products for as long as the contract is in place.

Contracts can be either three or five years. “Think of it as a gift card,” says Dhritiman Dasgupta, vice president of data center marketing at Cisco.

Cisco aims to get half its profits from software and pay-as-you-go-based products by 2020, he says. “Right now, I can’t think of a better example than ACI,” he says.

###

The contents or opinions in this feature are independent and may not necessarily represent the views of Cisco. They are offered in an effort to encourage continuing conversations on a broad range of innovative technology subjects. We welcome your comments and engagement.

We welcome the re-use, republication, and distribution of “The Network” content. Please credit us with the following information: Used with the permission of http://thenetwork.cisco.com/.

Cisco warns of malware droppers proliferating in a fake job posting

/0 Comments/in /by
  • Cisco Talos identified a malicious campaign posing itself a job posting in its Korean portal.
  • A Word document containing the ‘job description’ is found to have a macro code when initiated downloads an executable file.

Korean candidates could face unexpected obstacles while applying for Cisco jobs as a new malicious campaign has emerged with fake job postings under the networking company’s name on various job portals.

It has come to light that this campaign is spreading through a Word document disguised as a job posting on Cisco Korea portal. The ‘Job Description.doc’ contains parts of a code that downloads a malicious executable file.

In fact, the content in the document matches legitimate job descriptions put out by Cisco, which are publicly available on their site.

Expert attacker

In its blog post on this campaign, Cisco informed that this might be the work of an expert attacker. “Due to the targeted nature of this campaign, the lack of widespread indicator of compromise data, and the apparent nature of the targeting, this appears to be associated with a sophisticated attacker, “ it mentioned.

If the user downloads ‘Job Description.doc’, it extracts a malicious PE32 executable file called “jusched.exe” into the %APPDATA%\Roaming folder in the system. The PE32 file then attempts to contact a C2 server to check for additional instructions to execute on the system.

Additionally, the blog also highlighted how the attacker(s) managed to hide four API calls in the PE32 file so that it would make static analysis very difficult for security analysts.

A total of three legitimate job portals were said to be compromised in order to inject malicious content which includes www[.]secuvision[.]co[.]kr, ilovesvc[.]com, and www[.]syadplus[.]com.

Cisco has urged job applicants to be wary of suspicious documents lurking on these online job portals.