Your review has been sent successfully

Cisco Updates

3094
Classification
These posts contain security alerts, including digital loopholes, electronic attacks, technical updates, and they are classified base on the level of severity.

● Critical

● High

● Medium

● Low

Most Viewed Warnings

Dell EMC Alert

● Critical

F5 Alert

● High

IBM Alert

● Critical

Fortinet Alert

● High

Red Hat Alert

● High

حملات تصيدية تستهدف مايكروسوفت تيمز (Microsoft Teams)

● High

Warning Date

Severity Level

Warning Number

Target Sector

20 February, 2020

● High

2020-936

All

Description:

Cisco has released an updates to address a vulnerabilities in the following products:

  • Cisco Smart Software Manager On-Prem
    • Releases earlier than 7-202001 if the High Availability (HA) feature is enabled. HA is not enabled by default.

  • Cisco Unified Contact Center Express Software
    • Releases earlier than 12.5(1).

  • If they are running a vulnerable BIOS version and a vulnerable Cisco Integrated Management Controller (IMC) firmware release:
    • Firepower Management Center (FMC) 1000
    • Firepower Management Center (FMC) 2500
    • Firepower Management Center (FMC) 4500
    • Secure Network Server 3500 Series Appliances
    • Secure Network Server 3600 Series Appliances
    • Threat Grid 5504 Appliance

  • Cisco ESA
    • If they are running a vulnerable release of Cisco AsyncOS Software that is configured to use either Cisco AMP or message tracking.

  • Cisco SMA virtual and hardware appliances
    • If they are running a vulnerable release of Cisco AsyncOS Software that is configured to use either Cisco AMP or message tracking.

  • Cisco AsyncOS Software 12.1.0-085
    • Cisco Email Security Appliance (ESA).

  • Cisco AsyncOS Software 11.1.0-131
    • Cisco Email Security Appliance (ESA).

  • Cisco DCNM software
    • Releases earlier than Release 11.3(1).

  • Cisco Unified Contact Center Enterprise
    • Releases earlier than Release 12.5(1).

  • Cisco NFVIS
    • Releases 3.11.1 and earlier.

  • Identity Services Engine (ISE)
    • Release 2.6.0 patches 1, 2, and 3; and ISE 2.7.0 FCS.

  • Cisco Finesse
    • Releases earlier than Release 12.5(1).

  • Cisco ESA
    • Releases earlier than 12.5.1-037 and earlier than 13.0.0-375
  • Cisco Cloud Email Security (CES) software
    • Releases earlier than 12.5.1-037 and earlier than 13.0.0-375

  • Cisco CWS
    • Cisco Meeting Server deployments that are running a software release earlier than Release 2.8 and that have the XMPP feature enabled.

  • Cisco AnyConnect Secure Mobility Client for Windows
    • Releases earlier than 4.8.02042.

  • Cisco DCNM software
    • Release earlier than Release 11.3(1).

Threats:

Attacker could exploit these vulnerabilities by doing the following:

  • Gain access to a sensitive information.
  • Obtain read and write access to system data.
  • Execute arbitrary command.
  • Elevate privileges.
  • Bypass the signature validation checks
  • Denial of Service (DoS)
  • Sending a malicious email message through the targeted device.
  • Interact with the API with administrative privileges.
  • Upload crafted code to the affected device
  • Modify values on or return values from the underlying database.
  • Cross-site scripting (XSS)

Best practice and Recommendations:

The CERT team encourages users to review Cisco security advisory and apply the necessary updates:

Last updated at 20 February, 2020

Rate the content

rate-icon
up icon