Slashdot Mirror
Cisco Patches Serious Flaws In Cable Modems and Home Gateways (csoonline.com)
itwbennett writes: Cisco Systems has patched high-impact vulnerabilities in several of its cable modem and residential gateway devices that are distributed by some ISPs to their customers, and said in an advisory that customers should contact their service providers to ensure they have the patches. The embedded Web server in the Cisco Cable Modem with Digital Voice models DPC2203 and EPC2203 contains a buffer overflow vulnerability that can be exploited remotely without authentication. And the Web-based administration interfaces of the Cisco DPC3941 Wireless Residential Gateway with Digital Voice and Cisco DPC3939B Wireless Residential Voice Gateway are affected by a vulnerability that could lead to information disclosure. In addition, the Cisco Model DPQ3925 8x4 DOCSIS 3.0 Wireless Residential Gateway with EDVA is affected by a separate vulnerability, also triggered by malicious HTTP requests, that could lead to a denial-of-service condition.
there's no reason to have cisco's changelog on the slashdot main page. i asked many times to have csoonline articles ignore, but this spam-site that regurgitates the cisco changelogs with different words keep showing up
cable modems? in 2016? a buffer overflow in a cable modem is that important?
I thought Cisco sold off Linksys to Belkin.
" ... contains a buffer overflow vulnerability that can be exploited remotely without authentication.
The flaw could be exploited by sending specially crafted HTTP requests to the Web server and could result in arbitrary code execution. "
I've been seeing the above sentences for the past 20 years. I find it very puzzling that these sort of vulnerabilities are still being created, and why are they not being found during testing? Is it that a lot of tools and languages now hide the low level machine so much that some programmers have no understanding about what is actually happening? (or maybe I'm an old fart who learned using assembler and C ). What ever the reason, its obviously a hard problem to solve and I'd love to hear what is being done.
The biggest security hole is that Cisco is in charge.
...some of the ones that the corrupt ISPs "rent" to users for like $10/month? What a bargain!
and why are they not being found during testing?
Probably because the vast majority of ISP's don't use publicly addressable IP's for the cable modem interface, ever. And if they do, they're idiots.
The models with a builtin router/wireless router can be a little bit different story- but if you're worried about that then call them up, have them put the router into bridge mode, and buy your own router. Then you won't have to worry since the builtin router simply won't be running or even HAVE an IP assigned. Plus, if you use comcast you don't have to deal with that stupid Xfinity wifi bullshit they pull.
Does anyone have any idea if this was being exploited in the wild significantly?
The NSA told Cisco that these back doors are no longer needed.
The real "Libtards" are the Libertarians!
If you're using an ISP-provided modem, congratulations, U FAIL IT.
1: Buy a Surfboard.
2: Toss the ISP shit into the toilet, then call the ISP and tell them to come pick it up.
Probably because the vast majority of ISP's don't use publicly addressable IP's for the cable modem interface, ever. And if they do, they're idiots.
That still leaves room for CSRF attacks
Cisco is patching a lot theses days. Did they start a code audit?