Cisco Wednesday issued two new security alerts: one warning of default passwords in its Application Velocity System (AVS), and the other warning of a crafted IP packet flaw in its Cisco PIX 500 Series Security Appliance (PIX) and the Cisco 5500 Series Adaptive Security Appliance (ASA). That vulnerability could result in a reload of the devices.
Cisco warned that versions of AVS prior to software version AVS 5.1.0 do not prompt users to modify system account passwords during the initial configuration process. “Because there is no requirement to change these credentials during the initial configuration process, an attacker may be able to leverage the accounts that have default credentials, some of which have root privileges, to take full administrative control of the AVS system,” notes Cisco in its security alert. Cisco said it will be making free upgrade software to address this problem.
In a separate security advisory, Cisco is reporting that the PIX and ASA flaw could be triggered during processing of a crafted IP packet when the Time-to-Live (TTL) decrement feature is enabled. The Cisco PIX and ASA security appliances running software versions prior to 7.2(3)006 or 8.0(3) and that have the TTL decrement feature enabled are vulnerable. A patch and a workaround are available at Cisco’s Web site.
More Cisco Security Advisories
More Cisco Security Responses
More from Cisco Subnet:
* CCDE written test goes live. I passed. Can you?
* Surprise to Cisco? 2008 Technology of the Year Awards: Best IP PBX Asterisk 1.4
* Cisco’s a bad bet for phone systems according to Dell VoIP partner Fonality
* Juniper drops DX load balancing line – what does this mean for Cisco’s ACE?
* All you ever wanted to know about router security strategies, IP network traffic planes and more – just ask us
* Understanding MPLS explicit and implicit null labels
* Building your own CCNA lab
* VMWare brings networking into the server
* Win an iPod Touch; win a copy of ‘Firewall Fundamentals’ book
Go to Cisco Subnet for more Cisco news, blogs, discussion forums, security alerts, book giveaways, and more.
Recent Cisconet blog entries
Network World’s IT Buyer’s Guide: Cisco products
