Cisco Released Security Updates for Multiple Vulnerabilities that Affected Cisco Products

Cisco security updates released for multiple vulnerabilities that discovered form its products that include dangerous Remote Code Execution Vulnerability in Apache Struts .

Security update includes a remote attacker could exploit one of these vulnerabilities to take control of an affected system.

Cisco addressed 5 new vulnerabilities which categorized under Critical, High and Medium.

1. Apache Struts Remote Code Execution Vulnerability

A critical remote code execution vulnerability that discovered in Apache Struts leads an attack to perform an unauthenticated and execute arbitrary code on a targeted system.

an attacker could exploit this vulnerability by sending a request that submits malicious input to the affected application for processing.

Finally, attackers could execute arbitrary code on the target system and control victims machine.

You can see here the Affected products by Apache Struts remote code execution vulnerability

2.Linux Kernel IP Denial of Service Vulnerability

A vulnerability is known as Linux Kernel IP Fragment Reassembly Denial of Service

The vulnerability could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

An attack could be executed by an attacker who can submit a stream of fragmented IPv4 or IPv6 packets that are designed to trigger the issue on an affected device.

3.FreeBSD Kernels TCP Reassembly Denial of Service

An attack could be executed by using low transfer rates of TCP packets, unlike the typically distributed denial of service (DDoS) attacks.

This attack causes the remote attacker to cause a denial of service (DoS) condition on an affected device.

Due to inefficient TCP reassembly algorithms in the TCP stacks that are used by the affected kernels.

Linux Kernel Versions 4.9 and other supported version are affected by this vulnerability.

4. Cisco Data Center Network Manager Path Traversal Vulnerability

A directory traversal vulnerability that discovered in  Cisco Data Center Network Manager Path allows attackers gain access to sensitive files on the targeted system.

This vulnerability affected due to improper validation of user requests within the management interface which allow attacker sending a malicious request containing directory traversal character sequences within the management interface.

Also, the attacker can create arbitrary files on the targeted system. Cisco released software updates that address this vulnerability.

5.CPU Side-Channel Information Disclosure Vulnerabilities

According to the Cisco security updates, three vulnerabilities were disclosed by Intel and security researchers that leverage a speculative execution side-channel method referred to as L1 Terminal Fault (L1TF) that affects modern Intel microprocessors.

“These vulnerabilities could allow an unprivileged, local attacker, in specific circumstances, to read privileged memory belonging to other processes.”

• The first vulnerability, CVE-2018-3615, affects Intel SGX technology and is referred to by the researchers who discovered it as foreshadow.
• The second vulnerability, CVE-2018-3620, and the third vulnerability, CVE-2018-3646, are referred to as L1 Terminal Fault attacks by Intel

Also Read

Oracle Releases Critical Patch Update that Covers 334 Vulnerabilities Across All the Products

Debian 9.5 Released With Fix for Spectre v2 and Other Security Issues

Cisco Released Security Updates and Fixed Critical Vulnerabilities that Affected Cisco Products