Nov
15
2012
Cisco Linksys PlayerPT ActiveX Control Buffer Overflow
cisco-exploit

Cisco Linksys PlayerPT ActiveX is prone to an overflow condition. The SetSource() function fails to properly sanitize user-supplied input resulting in a stack based buffer overflow. With a specially crafted argument, a remote attacker can potentially cause execution of arbitrary code. Solution: Currently, there are no known upgrades or patches to correct this vulnerability. It is possible to correct the flaw by implementing the following workaround: set the kill-bit on the PlayerPT.ocx ActiveX Control [ {9E065E4A-BD9D-4547-8F90-985DC62A5591} ]. See Microsoft KB article 240797 for additional details.

Nov
12
2012
October 2012: five Cisco vulnerabilities
Cisco-vulnerabilities

The Cisco Product Security Incident Response Team (PSIRT) has published five important vulnerability advisories: Multiple Vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances and Cisco Catalyst 6500 Series ASA Services Module Multiple Vulnerabilities in Cisco Firewall Services Module Multiple Vulnerabilities in the Cisco WebEx Recording Format Player Multiple Vulnerabilities in Cisco Unified MeetingPlace Web Conferencing Cisco Prime Data Center Network Manager Remote Command Execution Vulnerability

Oct
18
2012
September 2012: eleven Cisco vulnerabilities
Cisco-vulnerabilities

The Cisco Product Security Incident Response Team (PSIRT) has published eleven important vulnerability advisories: Cisco IOS Software Network Address Translation Vulnerabilities Cisco IOS Software Intrusion Prevention System Denial of Service Vulnerability Cisco Unified Communications Manager Session Initiation Protocol Denial of Service Vulnerability Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability Cisco IOS Software DHCP Denial of Service Vulnerability Cisco IOS Software Tunneled Traffic Queue Wedge Vulnerability Cisco Catalyst 4500E Series Switch with Cisco Catalyst Supervisor Engine 7L-E Denial of Service Vulnerability Cisco IOS Software DHCP Version 6 Server Denial of Service Vulnerability Cisco IOS Software Malformed Border Gateway […]

Sep
18
2012
WhoisUP – Is your host up or down?
Whoisup

During last months, I have not written tutorial about Cisco technology because I have dedicated my free time to write my personal script to monitor hosts, router and so on. Why write a new script and not use a pre-existent script/software? The reasons are different, but in particular three: Surfing the web, I have found software that check hosts with a minute delay (they use crontab…), but in my case I want to check hosts continuously; other software can check hosts continually, but they are too complex for my purpose and they have features don’t needed in my case. They can be too expensive. The second reason […]

Aug
8
2012
July 2012: four Cisco vulnerabilities
Cisco-vulnerabilities

The Cisco Product Security Incident Response Team (PSIRT) has published four important vulnerability advisories: Multiple Vulnerabilities in Cisco TelePresence Immersive Endpoint Devices Multiple Vulnerabilities in Cisco TelePresence Manager Multiple Vulnerabilities in Cisco TelePresence Recording Server Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch Multiple Vulnerabilities in Cisco TelePresence Immersive Endpoint Devices Cisco TelePresence Endpoint devices contain the following vulnerabilities: Cisco TelePresence API Remote Command Execution Vulnerability Cisco TelePresence Remote Command Execution Vulnerability Cisco TelePresence Cisco Discovery Protocol Remote Code Execution Vulnerability Vulnerable Products Cisco TelePresence Manager, Cisco TelePresence Recording Server, Cisco TelePresence Multipoint Switch, and Cisco TelePresence Immersive Endpoint System may […]

Jul
4
2012
June 2012: four Cisco vulnerabilities
Cisco-vulnerabilities

The Cisco Product Security Incident Response Team (PSIRT) has published four important vulnerability advisories: Buffer Overflow Vulnerabilities in the Cisco WebEx Player Cisco Application Control Engine Administrator IP Address Overlap Vulnerability Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client Cisco ASA 5500 Series Adaptive Security Appliances and Cisco Catalyst 6500 Series ASA Services Module Denial of Service Vulnerability Buffer Overflow Vulnerabilities in the Cisco WebEx Player The Cisco WebEx Recording Format (WRF) player contains four buffer overflow vulnerabilities and the Cisco Advanced Recording Format (ARF) player contains one buffer overflow vulnerability. In some cases, exploitation of the vulnerabilities could allow […]

Jun
27
2012
How to configure Cisco VPN SSL aka WebVPN
How-to-configure-Cisco-VPN-SSL-aka-WebVPN

The SSL VPN feature (also known as WebVPN) provides support for remote user access to enterprise networks from anywhere on the Internet. Remote access is provided through a Secure Socket Layer- (SSL-) enabled SSL VPN gateway. The SSL VPN gateway allows remote users to establish a secure Virtual Private Network (VPN) tunnel using a web browser. This feature provides a comprehensive solution that allows easy access to a broad range of web resources and web-enabled applications using native HTTP over SSL (HTTPS) browser support. What is SSL? Secure Sockets Layer is a protocol developed by Netscape for transmitting private documents […]

Jun
6
2012
May 2012: one Cisco vulnerability
Cisco-vulnerabilities

The Cisco Product Security Incident Response Team (PSIRT) has published one important vulnerability advisory: Cisco IOS XR Software Route Processor Denial of Service Vulnerability Cisco IOS XR Software Route Processor Denial of Service Vulnerability The vulnerability only exists on Cisco 9000 Series Aggregation Services Routers (ASR) Route Switch Processor (RSP440) and Cisco Carrier Routing System (CRS) Performance Route Processor (PRP). The vulnerability is a result of improper handling of crafted packets and could cause the route processor, which processes the packets, to be unable to transmit packets to the fabric.

May
25
2012
How to create self-signed certificates
How-to-create-self-signed-certificates

A digital certificate or identity certificate is an electronic document which uses a digital signature to bind a public key with an identity, information such as the name of a person or an organization, their address, and so forth. The certificate can be used to verify that a public key belongs to an individual. In a typical public key infrastructure (PKI) scheme, the signature will be of a certificate authority (CA). However, there are situations where it is not possible use a CA, so the only solutions is to use a self-signed certificate, an identity certificate that is signed by […]

May
3
2012
April 2012: one Cisco vulnerability
Cisco-vulnerabilities

The Cisco Product Security Incident Response Team (PSIRT) has published one important vulnerability advisory: Buffer Overflow Vulnerabilities in the Cisco WebEx Player Buffer Overflow Vulnerabilities in the Cisco WebEx Player The Cisco WebEx Recording Format (WRF) player contains three buffer overflow vulnerabilities. In some cases, exploitation of the vulnerabilities could allow a remote attacker to execute arbitrary code on the system with the privileges of a targeted user.