Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
Re: [Full-disclosure] Drive-by Pharming
From: Brian Eaton (eaton.listsgmail.com)
Date: Fri Feb 16 2007 - 09:49:47 CST
On Thur, 16 Feb 2007 02:00:00 +0800, psirtcisco.com <psirtcisco.com> wrote:
> As the paper does not disclose any new vulnerability in Cisco products,
> Cisco is issuing this response and not a Security Advisory. The purpose
> of this response is to inform customers how to change any default
> credentials which may ship pre-configured on an impacted Cisco router
> (identified below), upon initial configuration and before the device is
> connected to a public network.
The Drive-by Pharming paper also relied on exploiting CSRF
vulnerabilities in the router web administration interfaces. Changing
the passwords does a lot to mitigate the risk, but the CSRF
vulnerabilities should be fixed.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/