From: Secunia Security Advisories (sec-advsecunia.com)
Date: Thu Sep 27 2007 - 13:17:13 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

----------------------------------------------------------------------

Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.

The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,700 different Windows applications.

Request your account, the Secunia Network Software Inspector (NSI):
http://secunia.com/network_software_inspector/

----------------------------------------------------------------------

TITLE:
Cisco Catalyst 6500 / Cisco 7600 Series Devices Accessible Loopback
Address Weakness

SECUNIA ADVISORY ID:
SA26988

VERIFY ADVISORY:
http://secunia.com/advisories/26988/

CRITICAL:
Not critical

IMPACT:
Security Bypass

WHERE:
From local network

OPERATING SYSTEM:
Cisco 7600 Series 12.x
http://secunia.com/product/15865/
Cisco Catalyst 6500 Series 12.x
http://secunia.com/product/15864/

DESCRIPTION:
A weakness has been reported in Cisco Catalyst 6500 and Cisco 7600
series devices, which can be exploited by malicious people to bypass
certain security restrictions.

The problem is that packets destined for the 127.0.0.0/8 network may
be received and processed by e.g. the Supervisor module or Multilayer
Switch Feature Card (MSFC). This can be exploited to e.g. bypass
existing access control lists.

Successful exploitation requires that systems are running Hybrid Mode
(Catalyst OS (CatOS) software on the Supervisor Engine and IOS
Software on the MSFC) or Native Mode (IOS Software on both the
Supervisor Engine and the MSFC).

The weakness is reported in all software versions on Cisco Catalyst
6500 and Cisco 7600 series prior to 12.2(33)SXH.

SOLUTION:
Update to 12.2(33)SXH.

PROVIDED AND/OR DISCOVERED BY:
The vendor credits Lee E. Rian.

ORIGINAL ADVISORY:
Cisco:
http://www.cisco.com/warp/public/707/cisco-sr-20070926-lb.shtml

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]