—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products

Advisory ID: cisco-sa-20140409-heartbleed

Revision 1.0

For Public Release 2014 April 9 03:00 UTC (GMT)

Summary
=======

Multiple Cisco products incorporate a version of the OpenSSL package affected by a vulnerability that could allow an unauthenticated, remote attacker to retrieve memory in chunks of 64 kilobytes from a connected client or server.

The vulnerability is due to a missing bounds check in the handling of the Transport Layer Security (TLS) heartbeat extension. An attacker could exploit this vulnerability by implementing a malicious TLS or Datagram Transport Layer Security (DTLS) client, if trying to exploit the vulnerability on an affected server, or a malicious TLS or DTLS server, if trying to exploit the vulnerability on an affected client. An exploit could send a specially crafted TLS or DTLS heartbeat packet to the connected client or server. An exploit could allow the attacker to disclose a limited portion of memory from a connected client or server for every heartbeat packet sent. The disclosed portions of memory could contain sensitive information that may include private keys and passwords.

Cisco is currently investigating its product line to determine which products may be affected by this vulnerability and the impact on the affected product. This advisory will be updated as additional information becomes available.

Cisco will release free software updates that address these vulnerabilities.
Workarounds that mitigate these vulnerabilities may be available.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed
—–BEGIN PGP SIGNATURE—–
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools – http://gpgtools.org

iQIcBAEBAgAGBQJTRLhxAAoJEIpI1I6i1Mx3JOQP/09jLm0nSAp/xxKdPH6ch9LN
GfakZ2HyqHjEviTcwao63Ovj1sabvRcWss5g3C+sqEL42gYFBHU3t8SznB+HJLQI
kyTa3N94Jy/3k6eGdkF60RXI/5Tjox1pdeXacb9Evo9fROJOeX+TXuEVqrxKTydO
0MxEidSYZSsBnPtDBNc+ofoQfFhKQ9ZFnSmLhrgMQmFjCMfQ3GHVK/qECcsLFUMj
5tLdw22z7gALExUUwJvlKFsY5CGiRCrj5XUcgYMKIj54SYlzHRJuxVbqt+66QHwX
ohh7GJz7qHCn3/AU5PK5BGOe0/rzyibwKfbaNCMot4lZpmDMK/29UpQdYuDq50yp
OtEUh32+2BdxvNHKsU+Cq/k1rfZLGYMy4dSR6jvMj36BOl7Q2+DX4KacqQnjeMOS
6cKWnIMCVjtYYqi6lTaokV3VyiCADEvlkqyl1e6IGi+DBBrGNfaUkrMclRydbFKg
c2EYanb7pazXtO2MYp80IwrtQsvSFfNxTLqSgXJSIthHz00SgQGFEmDtAySShM7Q
P2kKGgXl8AYNPTj1nsBpzfrSUhbdHNp8g5VIZBDSatcYROrmsytYcHn8jexLkud+
eOcUHx65Sy+tVGd/bKwOroMfdevRjWLyaqUHH9i77lfknJGjwwKYtn6cN53/G9+/
EJ9K7MfbvMacbqu8n+3g
=PkOQ
—–END PGP SIGNATURE—–
_______________________________________________
cust-security-announce mailing list
cust-security-announce@cisco.com
To unsubscribe, send the command “unsubscribe” in the subject of your message to cust-security-announce-leave@cisco.com

 

 

 

 

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

Multiple Vulnerabilities in Cisco TelePresence System MXP Series

Advisory ID: cisco-sa-20140430-mxp

Revision 1.0

For Public Release 2014 April 30 16:00 UTC (GMT)

Summary
=======

Cisco TelePresence System MXP Series Software contains the following vulnerabilities:
Three SIP denial of service vulnerabilities
Three H.225 denial of service vulnerabilities

Successful exploitation of these vulnerabilities may allow an attacker to cause system instability and the affected system to reload.

Note: This security advisory does not provide information about the OpenSSL TLS Heartbeat Read Overrun Vulnerability identified by CVE-2014-0160 (also known as Heartbleed). For additional information regarding Cisco products affected by the Heartbleed vulnerability, refer to the Cisco Security Advisory available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed

Cisco has released free software updates that address these vulnerabilities.
There are no workarounds that mitigate these vulnerabilities.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-mxp
—–BEGIN PGP SIGNATURE—–
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools – http://gpgtools.org

iQIcBAEBAgAGBQJTYR4GAAoJEIpI1I6i1Mx3uZMP/R5dy6VQ54g0W2niaUcTStr9
s/7SAcSY9D2RIBB9P/Z11aA3gSa7a59Ee4Cx9BCw6oW+FEg1WkUS0zxYcMps4N7p
mAtdedibXPZzEkzkkAoWlJ9d7ZCzmcXRGtd1Q7xR/+5t/kDBRehcswyal5DF1zdZ
hTaOAem71bu0AMsR1TJqOPyvkL2Mo5HLdoX4USS+3NpFeRkd3n+W9L9Y1BZnJkZZ
UUABeFVt07pabCdx+XvLhwUZX4FlJ+VNPg8TTmZ3UyaRTzg+vzGW+ehnq430fivD
wuDvcUwqacJhKqneKRAcQwqHcYV//SCoWsfzKU6hmStbLLGuBWtPQCKIYf5AOGU0
omTsivEsMKsFYfY6QNuMZVxWBL4+2c/AZm1deqJGDK7acKlBDqPcMQh5ajUJhjAb
yFAxuD5328GF0qvuz+TdW70c/ycL1KBF5GGycQ/sBaLFICseGSUZB1sbbt2/zMig
I7WHVTRvMyYiaUpJWtC5SnVXw6JvdF6Jg2UznYZWSxW+aFzv6wlgfOHFHdSgr5Ut
FdwNXul2kQ2jEAIc/1/epV4c/JuAq2xniHqSPQ1vzEWhdht0YcxTnesiN6mLazF6
2lZl09JzjtiVo7HdnrKRnOXhw1fJ2lktVd5os6l2uGfE2cQ5jX43pFvD+vdBn5Z5
SBZPfxs0xeOXar+k1RfT
=ZX9C
—–END PGP SIGNATURE—–
_______________________________________________
cust-security-announce mailing list
cust-security-announce@cisco.com
To unsubscribe, send the command “unsubscribe” in the subject of your message to cust-security-announce-leave@cisco.com

 

 

 

 

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

Multiple Vulnerabilities in Cisco TelePresence TC and TE Software

Advisory ID: cisco-sa-20140430-tcte

Revision 1.0

For Public Release 2014 April 30 16:00 UTC (GMT)

Summary
=======

Cisco TelePresence TC and TE Software are affected by the following vulnerabilities:
Six Session Initiation Protocol (SIP) denial of service vulnerabilities
Cisco TelePresence TC and TE Software DNS Buffer Overflow Vulnerability
Cisco TelePresence TC and TE Software Input Validation Vulnerability
Cisco TelePresence TC and TE Software tshell Command Injection Vulnerability
Cisco TelePresence TC and TE Software Heap Overflow Vulnerability
Cisco TelePresence TC and TE Software U-Boot Buffer Overflow Vulnerability
Cisco TelePresence TC and TE Software Unauthenticated Serial Port Access Vulnerability
Cisco TelePresence TC H.225 Denial of Service Vulnerability

Successful exploitation of these vulnerabilities could allow an attacker to cause the affected system to reload, execute arbitrary commands or obtain privileged access to the affected system.

Note: This security advisory does not provide information about the OpenSSL TLS Heartbeat Read Overrun Vulnerability identified by CVE-2014-0160 (also known as Heartbleed). For additional information on Cisco products affected by the Heartbleed vulnerability, refer to the Cisco Security Advisory available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed

Cisco has released free software updates that address these vulnerabilities.
There are no workarounds that mitigate these vulnerabilities.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140430-tcte
—–BEGIN PGP SIGNATURE—–
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools – http://gpgtools.org

iQIcBAEBAgAGBQJTYR4LAAoJEIpI1I6i1Mx3TJYQAKPF2T8b5PUVB6SfesgPMAjc
V/YIgeSzoMNsEZvZgoM2Qvjdx03j4PvHj+ecQgqxEzYoHGXwKxhT64kOl9atmQac
Xxms2GRkoDtrBZYBo1mbNSgbAR/eCe7iFsBrz23ciJax38VO4bxmuhtRMzZJcu/w
6mGXcbNqiEY+v42FkX7PeeWSCeepu0SDxF68QHsEOh3YGhI1BZ2nTBhNedlSdRJu
UKwMxbnj/qpX9NUwkYluKFmgQjZ3ZuImnZT2HjlWunksFPo2BCKSLDX5lufiLjog
5hR+vWPMsA/napuJ9tPZUpyikTXwm2iej8hPqWAERzF2WHbXsWjS7HvOFU0A9hX6
9n8ey0B9rxZzM7+8B10bqveF3FaAfY6Ilc3t2aRxH52IZdj1mN7CeGkbyMXQvuae
JPH+7F8xIbDoQvalmGFtTqgDmjZyxW+UXALfqcjmePJdvYGKIvr8MuG2s/fP8sYa
IDMRRKVxE1gCjER8Hjp7CVOUsNsPB+fnDZFB84sKcAeKSRhDjNjodAwhXfBBwQrv
iK0t6AHtiIabsQw+OyOvQWeaZPx1ltjJkD+iLl7CGlZrde8vop26RScCp2IQRUsp
sUIdYFaUnf8xkZVgjljoNOZBBBH4Frb0N2kiW/9EmS/A/azOupJEguI7WaEoYdDU
VDEhLhJG9uTVJAdPsEEy
=e0Do
—–END PGP SIGNATURE—–
_______________________________________________
cust-security-announce mailing list
cust-security-announce@cisco.com
To unsubscribe, send the command “unsubscribe” in the subject of your message to cust-security-announce-leave@cisco.com