19 cisco advisories yesterday

Started by icecream-guy, October 27, 2016, 06:17:35 AM

Previous topic - Next topic

icecream-guy

:professorcat:

My Moral Fibers have been cut.

icecream-guy

this one gonna hurt lots of peoples...

On October 19, 2016, a new vulnerability related to a race condition in the memory manager of the Linux Kernel was disclosed. This vulnerability could allow unprivileged, local users to gain write access to otherwise read-only memory mappings to increase their privileges on the system.


and the ISE one looks like it's gonna hurt.

A vulnerability in the web framework code of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary SQL commands on the database.

The vulnerability is due to insufficient controls on Structured Query Language (SQL) statements. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected system. An exploit could allow the attacker to determine the presence of certain values in the database.

Cisco has not released software updates that address this vulnerability. Workarounds that address this vulnerability are not available.
:professorcat:

My Moral Fibers have been cut.

deanwebb

Yay me using ForeScout CounterACT for NAC!
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

mmcgurty

Where do you guys go to get regular updates on these advisories?

icecream-guy

:professorcat:

My Moral Fibers have been cut.