Cisco Patches Critical Flaw After PoC Exploit Code Release

  • A critical route-traversal flaw (CVE-2020-27130) exists in Cisco Security Supervisor that lays bare sensitive info to remote, unauthenticated attackers.

    A day after evidence-of-notion (PoC) exploit code was released for a critical flaw in Cisco Security Manager, Cisco has hurried out a patch.

    Cisco Security Manager is an stop-to-close security management software for organization directors, which gives them the ability to enforce various security insurance policies, troubleshoot security activities and deal with a broad assortment of units. The software has a vulnerability that could let distant, unauthenticated attackers to accessibility delicate data on impacted systems. The flaw (CVE-2020-27130) has a CVSS score of 9.1 out of 10, generating it critical.

    “An attacker could exploit this vulnerability by sending a crafted ask for to the impacted product,” according to Cisco, in a Tuesday investigation. “A productive exploit could let the attacker to obtain arbitrary files from the impacted unit.”

    In accordance to Cisco, the flaw stems from the poor validation of listing traversal character sequences inside requests to an afflicted unit. A path-traversal attack aims to entry information and directories that are stored outdoors the web root folder. If an attacker manipulates variables referencing documents (with “dot-dot-slash (../)” sequences), it is possible to obtain arbitrary information and directories stored on file program, such as software supply code, or configuration and critical system files.

    PoC exploits for the flaw – as effectively as 11 other issues in Cisco Security Supervisor – ended up revealed on the web Monday by security researcher Florian Hauser. Hauser stated in a Monday tweet that he had formerly described the flaws 120 days in the past – nevertheless, Cisco “became unresponsive and the posted release 4.22 nonetheless doesn’t mention any of the vulnerabilities.”

    Since Cisco PSIRT grew to become unresponsive and the released release 4.22 still would not mention any of the vulnerabilities, here are 12 PoCs in 1 gist:

    — frycos (@frycos) November 16, 2020

    In a follow-up tweet on Tuesday, Hauser reported: “Just experienced a excellent phone with Cisco! The lacking vulnerability fixes have been indeed applied as properly but have to have some even more tests. SP1 will be introduced in the following few weeks. We observed a superior mode of collaboration now.”

    The flaw influences Cisco Security Supervisor releases 4.21 and earlier the issue is fastened in Cisco Security Supervisor Release 4.22.

    Other Security Supervisor Bugs

    Cisco on Tuesday also disclosed two significant-severity vulnerabilities in Cisco Security Supervisor. Just one of these (CVE-2020-27125) stems from insufficient defense of static qualifications in the afflicted software package. This flaw could allow for a distant, unauthenticated attacker to accessibility delicate information and facts on an afflicted system, in accordance to Cisco.

    “An attacker could exploit this vulnerability by viewing supply code,” according to Cisco. “A successful exploit could let the attacker to perspective static qualifications, which the attacker could use to have out further assaults.”

    The other flaw exists in the Java deserialization function that is employed by Cisco Security Supervisor, and could make it possible for an unauthenticated, distant attacker to execute arbitrary commands on an impacted machine.

    That flaw (CVE-2020-27131) stems from insecure deserialization of user-provided information by the afflicted computer software, in accordance to Cisco.

    “An attacker could exploit these vulnerabilities by sending a malicious serialized Java object to a unique listener on an influenced procedure,” said Cisco’s advisory. “A successful exploit could enable the attacker to execute arbitrary commands on the unit with the privileges of NT AUTHORITYSYSTEM on the Windows goal host.”

    Cisco has just lately dealt with various flaws across its product or service line. Final week, the networking large warned of a superior-severity flaw in Cisco’s IOS XR software package that could permit unauthenticated, distant attackers to cripple Cisco Aggregation Services Routers (ASR). Cisco also not too long ago disclosed a zero-day vulnerability in the Windows, macOS and Linux variations of its AnyConnect Protected Mobility Client Program.

    Hackers Set Bullseye on Healthcare: On Nov. 18 at 2 p.m. EDT come across out why hospitals are acquiring hammered by ransomware attacks in 2020. Save your spot for this Totally free webinar on health care cybersecurity priorities and hear from foremost security voices on how knowledge security, ransomware and patching have to have to be a precedence for just about every sector, and why. Join us Wed., Nov. 18, 2-3 p.m. EDT for this Reside, restricted-engagement webinar.