Security vendor Symantec has announced two severe vulnerabilities, the first in five versions of Microsoft's operating system and the second in Cisco's routing equipment. The level of alarm in Symantec's DeepSight ThreatCon has been raised by one notch.
A vulnerability affecting the core of the Microsoft Windows operating system has particular significance because it "does not require any prior authentication for an attacker to exploit it", Symantec says. An attacker only has to connect to port TCP/135 on a vulnerable system. Once exploited, the attacker will have full access to the targeted system.
The vulnerability affects Windows NT 4.0, Windows NT 4.0 Terminal Services Edition, Windows 2000, Microsoft Windows XP and Microsoft Windows Server 2003.
Symantec recommends that administrators and users patch their systems immediately. "Organisations and consumers are encouraged to implement firewalls, to prevent systems from being compromised. Administrators can block TCP port 135 at the firewall, but personal firewall products can also assist in blocking traffic to this service," the company says.
Cisco's problem and fix
In Cisco's case, the company has issued an advisory regarding a denial of service vulnerability in Cisco IOS versions 11.x and 12.x. This vulnerability affects all Cisco hardware running the vulnerable IOS versions, and configured to process IPv4 traffic (which is a default setting on all Cisco devices). Devices running only Ipv6 are not affected.
"This is a serious vulnerability as it affects a significant number of infrastructure devices, on both corporate and core Internet networks," says the statement issued by Symantec today.
Cisco has warned that specially crafted IPv4 packets with modified headers may stop the device processing traffic once the input queue is mistakenly signalled to be full. A reboot of the affected device is required to clear the input queue.
Full details are available from Cisco. Due to the critical nature of the affected devices, the company urges administrators to upgrade to the latest version of Cisco IOS as soon as possible.
Customers with contracts should obtain upgraded software free of charge through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Centre.
Customers whose Cisco products are provided or maintained through agreement with third-party support organisations such as Cisco partners, authorised resellers, or service providers should contact that support organisation for assistance with obtaining the free software upgrade(s).
Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Centre (TAC) on +1 408 526 7209 (a toll call from anywhere in the world).
Symantec Security Response says it will monitor any unusual activities through its 19 000 sensors and security operation centres worldwide and provide updates as available.
Share
