Slashdot Mirror
Cisco Patches Authentication, Denial-of-Service, NTP Flaws In Many Products (csoonline.com)
itwbennett writes: Cisco Systems has released a new batch of security patches for flaws affecting a wide range of products, including for a critical vulnerability in its RV220W wireless network security firewalls. The RV220W vulnerability stems from insufficient input validation of HTTP requests sent to the firewall's Web-based management interface. This could allow remote unauthenticated attackers to send HTTP requests with SQL code in their headers that would bypass the authentication on the targeted devices and give attackers administrative privileges.
HTTP requests with SQL code: about using prepared statements and parameterized queries?
Everything I write is lies, read between the lines.
The only cause of SQLi is gross incompetence. It can never be caused by an accident or failure to do something.
It can only caused by willful and deliberate action to do something you know or should know to be wrong, stupid and dangerous at the time you did it. Unbound query strings don't build themselves.
Why are you the only one posting stories recently? The other two crappy editors who posted dupes haven't been heard from in a while.
Hey timothy, I dare you, post another link to forbes.com.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
A great part of the Internet is woven together by those turquoise boxes. They form a vulnerable part of the infrastructure. I find it strange that open source tinfoil hatters have not criticized more the fact that all of that gear runs proprietary code. All of the boxes could have a backdoor that allows a government surveillance organization to connect and change settings or to wiretap passing traffic. Why do not these discussions usually come up?
If Cisco can't get it right then what hope does the rest of us have. But then again using a html protocol to remotely control a security device isn't the best of ideas.
Was never supposed to be an "enterprise" piece of equipment anyway. It's part of their Small Business line, which used to be called Linksys. Thus why it has an HTML-based gui, craptastic security, etc. If you want decent hardware with the Cisco name, prepare to spend around $1,000 for an ASA 5500 series, and then another $500+ for an Aironet to get the wireless. You get what you pay for, and Cisco has never been cheap. If the product is cheap, then expect issues like there. I finally gave up on my RW180 because it just wouldn't keep the PAT going after a few hours. Even when their tech remoted in and checked that it was all set up properly, it still died after less than a day and required a reboot to get it to work again. So far, the $25 small form factor Dell with PfSense is running far better and has had zero issues.
If anyone else ends up clicking the "security updates" link in the summary and starts to wonder why they are only talking about the RV220W, it's because the submitted reversed the links, you need to click the Cisco RV220W link to get the article with ALL the products.
This stuff is the crap leftover from the Linksys acquisition. I would be willing to bet none of their SMB products share much code with their big business stuff (ASA, Catalyst, and their real routers based on IOS).
If you've ever called tech support for their "pro" stuff - you get some pretty awesome people usually based in the US. Last time I called their SMB support teams I got a guy in Bulgaria (in his defense he did quickly recognize that my defective hardware needed to be replaced).
This type of flaw is probably not a systemic problem with Cisco's other products.