Daily Archives: September 25, 2015

Cisco Releases Scheduled Security Updates For IOS and IOS XE

Earlier this week Cisco released security updates to address authentication bypass and denial of service (defined) security vulnerabilities within Cisco IOS and IOS XE.

Why Should These Issues Be Considered Important?
The SSHv2 RSA authentication bypass vulnerability could allow an unauthenticated remote attacker to obtain the access privileges of the logged in user or the privileges of the Virtual Teletype (VTY) line which could be admin privileges. The attacker would however need to know a valid user name and possess a specifically crafted private key. The only workaround to this issue is to disable RSA based SSHv2 authentication.

Meanwhile a vulnerability in the processing of IPv4 packets that require Network Address Translation (NAT) and Multiprotocol Label Switching (MPLS) services could allow an unauthenticated remote attacker to cause your Cisco IOS XE device to stop functioning (namely a denial of service attack. The attacker would only need to send the device a specifically crafted IPv4 (defined) packet.

This flaws affects the following products:

  • Cisco ASR 1000 Series
  • Cisco ISR 4300 Series
  • Cisco ISR 4400 Series
  • Cisco Cloud Services 1000v Series Routers

Separately 2 vulnerabilities in the IPv6 snooping feature from the first-hop security features in Cisco IOS and IOS XE Software could also cause a denial of service issue. For an attacker to exploit the insufficient validation of IPv6 ND packets they would only need to send it a malformed IPv6 packet. For the second flaw, the insufficient Control Plane Protection (CPPr) against specific IPv6 ND packets an attacker would need to send a large amount of specifically crafted IPv6 ND packets to a vulnerable device.

For the vulnerabilities involving the processing of IPv4 and IPv6 (defined) packets, no workarounds are available (apart from disabling the IPv6 snooping feature) to mitigate the 2x IPv6 flaws until the appropriate security updates are installed.

The remaining vulnerabilities affect any Cisco device running IOS and/or IOS XE. As you can see, only the access bypass issue is likely to pose a challenge to a determined adversary, all other issues discussed above could potentially be easily exploited.

How Can I Protect Myself From These Issues?
Within the Cisco security advisory you can use the link provided to access the Cisco IOS Software Checker to determine if your Cisco IOS device is vulnerable to these issues. This security advisory also provides the links to the individual advisories for each vulnerability which contain the steps to install the appropriate updates.

Thank you.

HP Adds Security Features To Enterprise Printer Firmware

Earlier this week HP announced that their range of enterprise class LaserJet printers would include security features to better secure them against external attacks.

The printer models that include these features are the following:

  • HP LaserJet Enterprise M506 series
  • HP LaserJet Enterprise MFP M527 series
  • HP Color LaserJet Enterprise MFP M577 series

In addition, printers manufactured since 2011 should be able to benefit from some of the new security enhancements via a HP FutureSmart service pack update.

The security improvements enable the printers to defend against having their BIOS (defined) updated with a maliciously tampered version. In addition, only known good firmware can be executed (allowed to run/function). Moreover the printers feature a runtime intrusion detection system that prevents malware from being loaded into the printer’s memory.

Such printers can also take advantage of HP JetAdvantage Security Manager software that allows the IT administrator to enforce a security policy to allow them to disable unused access protocols (reducing the possibility of external attack), closing networking ports and erasing documents stored within the printers memory/hard disk to maintain confidentiality. When a printer is rebooted, all of the settings specified within the security policy will be enforced returning the printer to a known good and compliant state.

More information on these new printer models is available here and here. A link to the firmware updates for older printer models is provided above.

These security enhancements should enhance an enterprise’s security posture by preventing confidential documents from leaving the organization via networked printers or from malware installed on the printer capturing documents sent for printing or stored in the printer’s hard disk or memory. According to HP they are currently the only printer manufacturer to offer these security features but other manufacturers will likely follow suit. These features will make a worthwhile addition to have if you are considering replacing/upgrading your enterprise printer in the future.

Thank you.