Cisco Released Security Updates and Fixed Critical Vulnerabilities that Affected Cisco Products

Cisco Security updates released with fixes for 8 vulnerabilities that affected the Cisco products and one those flaws allow remote attackers to execute the arbitrary code and taking the system control.

Security updates contain 2 severity flow fixed under “Critical” category and the remaining 6 vulnerabilities are addressed under “Medium” severity.

Cisco does not provide vulnerability details that could enable someone to craft an exploit and the fixed vulnerabilities are affected directly by the Cisco products.

Critical Vulnerabilities Under Cisco Security updates

 1. Denial of Service Vulnerability (CVE-2018-0368) 

A critical vulnerability existing in the reassembly logic for fragmented IPv4 packets of Cisco StarOS running on virtual platforms allow a remote attacker can perform reload the process leads to perform denial of service (DoS) attack.

Improper handling of fragmented IPv4 packets Allows an attacker could exploit this vulnerability by sending a malicious IPv4 packet across an affected device.

2. Web UI Command Injection Vulnerability(CVE-2018-0341)

A command injection vulnerability affected the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware which allow an attacker perform a command injection and execute commands with the privileges of the web server.

Medium Severity Vulnerabilities

1.Credential Logging Information Disclosure Vulnerability (CVE-2018-0368 )

A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, local attacker to access sensitive information on an affected system.

2. Denial of Service Vulnerability (CVE-2018-0385)

A vulnerability in the detection engine parsing of Security Socket Layer (SSL) protocol packets for Cisco Firepower System Software could allow an attacker to perform a denial of service (DoS) condition due to the Snort process unexpectedly restarting.

3. Access Control Policy Bypass Vulnerability (CVE-2018-0384)

A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a URL-based access control policy that is configured to block traffic for an affected system.

4. Policy Bypass Vulnerability (CVE-2018-0383)

A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a file policy that is configured to block the transfer of files to an affected system via FTP.

5. Denial of Service Vulnerability (CVE-2018-0370)