[SECURITY-L] CAIS-Alerta: Multiplas vulnerabilidades no CISCO IOS (SA31990)

[CSIRT - UNICAMP]

----- Forwarded message from Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br> -----

From: Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br>
Subject:  CAIS-Alerta: Multiplas vulnerabilidades no CISCO IOS (SA31990)
To: pop-seg em cais.rnp.br, rnp-alerta em cais.rnp.br, rnp-seg em cais.rnp.br
Date: Tue, 30 Sep 2008 09:12:12 -0300 (BRT)

-----BEGIN PGP SIGNED MESSAGE-----


Prezados,

O CAIS esta' repassando o alerta da Secunia, intitulado "SA31990 - Cisco 
IOS Multiple Vulnerabilities", que trata de 16 vulnerabilidades reportadas 
pela CISCO e que afetam seu sistema IOS.

As vulnerabilidades sao consideradas criticas pelo fabricante uma vez que 
afetam equipamentos de infra-estrutura de redes e que se exploradas podem 
permitir a um atacante remoto causar negacao de servico, obter informacoes 
sensiveis ou mesmo acessar o equipamento com privilegios indevidos.

O ISC - SANS Internet Storm Center - avaliou as vulnerabilidades e 
disponibilizou a seguinte classificacao:

cisco-sa-20080924-iosips 	- Critica
cisco-sa-20080924-ssl		- Critica
cisco-sa-20080924-sip		- Importante
cisco-sa-20080924-cucm		- Critica
cisco-sa-20080924-vpn		- Importante
cisco-sa-20080924-mfi		- Critica
cisco-sa-20080924-ipc		- Critica
cisco-sa-20080924-ubr		- CORRIGIR AGORA
cisco-sa-20080924-multicast	- CORRIGIR AGORA
cisco-sa-20080924-sccp		- CORRIGIR AGORA
cisco-sa-20080924-iosfw		- CORRIGIR AGORA
cisco-sa-20080924-l2tp		- Critica

As vulnerabilidades marcadas como "CORRIGIR AGORA" indicam a existencia de 
"perigo imediato de exploracao da vulnerabilidade" seguindo a analise do 
ISC, sendo necessaria a correcao imediata do problema.


SISTEMAS AFETADOS

. Cisco IOS 12.x
. Cisco IOS R12.x


CORRECOES DISPONIVEIS

Recomenda-se fazer a atualizacao para as versoes disponiveis no site 
oficial do fornecedor.


MAIS INFORMACOES

. SA31990: Cisco IOS Multiple Vulnerabilities
  http://secunia.com/advisories/31990/

. CISCO Security Advisories
  http://www.cisco.com/en/US/products/products_security_advisories_listing.html

. Cisco Releases Security Alerts
  http://www.us-cert.gov/current/current_activity.html

. Cisco Unified Communications Manager Session Initiation Protocol
  Message Reload Denial of Service Vulnerability
  http://tools.cisco.com/security/center/viewAlert.x?alertId=16667

. Cisco IOS Software L2TP Packet Handling Denial of Service Vulnerability
  http://tools.cisco.com/security/center/viewAlert.x?alertId=16650

. Cisco IOS Multiprotocol Label Switching Virtual Private Network
  Information Disclosure Issue
  http://tools.cisco.com/security/center/viewAlert.x?alertId=16669

. Cisco IOS Linecard Redundancy Unauthorized Access Vulnerability
  http://tools.cisco.com/security/center/viewAlert.x?alertId=16634

. Cisco IOS Software Session Initiation Message Memory Leak Denial of
  Service Vulnerability
  http://tools.cisco.com/security/center/viewAlert.x?alertId=16651

. Cisco IOS Skinny Call Control Protocol Fragmented Message Denial of
  Service Vulnerability
  http://tools.cisco.com/security/center/viewAlert.x?alertId=16670

. Cisco IOS IPS Feature SERVICE.DNS Signature Engine Network Traffic
  Handling Denial of Service Vulnerability
  http://tools.cisco.com/security/center/viewAlert.x?alertId=16656

. Cisco IOS IPC Message Denial of Service Vulnerability
   http://tools.cisco.com/security/center/viewAlert.x?alertId=16646

. Cisco IOS Multi Protocol Label Switching Forwarding Infrastructure
  Denial of Service Vulnerability
  http://tools.cisco.com/security/center/viewAlert.x?alertId=16635

. SANS ISC Handler's Diary 2008-09-25: CISCO bi-annual patch day 
  http://isc.sans.org/diary.html?storyid=5078


Identificador CVE (http://cve.mitre.org):
CVE-2008-2739, CVE-2008-3798, CVE-2008-3799, CVE-2008-3800,
CVE-2008-3801, CVE-2008-3802, CVE-2008-3803, CVE-2008-3804,
CVE-2008-3805, CVE-2008-3807, CVE-2008-3808, CVE-2008-3809,
CVE-2008-3810, CVE-2008-3811, CVE-2008-3812, CVE-2008-3813


O CAIS recomenda que os administradores mantenham seus sistemas e 
aplicativos sempre atualizados, de acordo com as ultimas versoes e 
correcoes oferecidas pelos fabricantes.

Os Alertas do CAIS tambem sao oferecidos no formato RSS/RDF:

http://www.rnp.br/cais/alertas/rss.xml

Atenciosamente,

################################################################
#   CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS)     #
#       Rede Nacional de Ensino e Pesquisa (RNP)               #
#                                                              #
# cais em cais.rnp.br       http://www.cais.rnp.br                #
# Tel. 019-37873300      Fax. 019-37873301                     #
# Chave PGP disponivel   http://www.rnp.br/cais/cais-pgp.key   #
################################################################

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Made with pgp4pine 1.76

iQCVAwUBSOIX1ukli63F4U8VAQGbtgP+Oh7fReO6oKaC+NUTabYfoitddpW89SJp
2PeuWkPwExiM7SVmZhyyiWbLS2kXppCBJuxlQbLL+3q4bwLkq5uxnzTeacqgzov4
j0jaAU6nef4I6AtSbaTCXbBpLJrGOmVU0w5TPKatXOjAcmeWIR7K507auVZ+8gmf
B3op5BZygpM=
=Qf6O
-----END PGP SIGNATURE-----


----- End forwarded message -----