Cisco reports vulnerabilities in products
Cisco has discovered a buffer overflow in version 2.6 of CiscoWorks Internetwork Performance Monitor (IPM) and previous versions for Windows; the flaw allows attackers to compromise vulnerable systems remotely. The vendor says that attackers only need a specially crafted "CORBA GIOP" request. IPM 2.x for Solaris and IPM 4.x for Windows and Solaris are not affected. Cisco will not be providing an update, but instead recommends that users upgrade to the current version.
Cisco is also reporting the discovery of a denial-of-service (DoS) vulnerability in Cisco IOS XR that allows flawed packets to cause individual SSH processes to crash. According to the description, entire systems could also be detrimentally affected because each successful attack occupies a little more memory. An update (see Software Versions and Fixes in the second advisory) remedies the flaw.
See also:
- CiscoWorks Internetwork Performance Monitor CORBA GIOP Overflow Vulnerability, a Cisco security advisory.
- Cisco IOS XR Software SSH Denial of Service Vulnerability, a Cisco security advisory.
(crve)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
