Cisco released security updates to address vulnerabilities in multiple products on Wednesday. Two of the bugs were rated critical and 11 rated high severity. Another 18 Medium severity updates were also released this week.Â
The first critical fix addresses a vulnerability (CVE-2018-0321) in Cisco Prime Collaboration Provisioning (PCP), which could allow an unauthenticated, remote attacker to access the Java Remote Method Invocation (RMI) system.
“The vulnerability is due to an open port in the Network Interface and Configuration Engine (NICE) service. An attacker could exploit this vulnerability by accessing the open RMI system on an affected PCP instance. An exploit could allow the attacker to perform malicious actions that affect PCP and the devices that are connected to it,” Cisco stated in the PCP advisory.
The second critical patch fixes a vulnerability in the authentication, authorization, and accounting (AAA) security services of Cisco IOS XE Software. If unpatched, this bug (CVE-2018-0315) could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device or cause a denial of service (DoS) via a device reload.
“The vulnerability is due to incorrect memory operations that the affected software performs when the software parses a username during login authentication,” Cisco added in the IOS XE advisory.
Each of the critical vulnerabilities are rated 9.8 CVSS score (10 being the highest possible).
Multiple other high severity bugs, to include SQL Injection, unauthorized password reset and access control, were also fixed in Cisco’s PCP product.
Cisco also issued security updates for other products to include Cisco’s Web Security Appliance (WSA), Network Services Orchestrator (NSO), WebEx and Cisco IP Phone 6800, 7800, and 8800 Series Phones, to name a few.
Finally, one high risk vulnerability of important note affects multiple Cisco products. The bug (CVE-2017-6779) affects local file management for certain system log files of Cisco collaboration products. If exploited, this could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The rating on this one is a notch just below critical and is rated a CVSS score of 8.6, so should also not be taken lightly.
You may also check out Cisco’s full list of security patches and alerts. Network admins are strongly encouraged to patch as soon as possible.