Security News
Cisco yesterday released security patches for two high-severity vulnerabilities affecting its IOS XR software that were found exploited in the wild a month ago. Tracked as CVE-2020-3566 and CVE-2020-3569, details for both zero-day unauthenticated DoS vulnerabilities were made public by Cisco late last month when the company found hackers actively exploiting Cisco IOS XR Software that is installed on a range of Cisco's carrier-grade and data center routers.
Phunware announced that Cisco Meraki will now feature the Company's Smart Workplace solution for employers in its Meraki Marketplace. Cisco Systems acquired Meraki in 2012, and today, Cisco Meraki is a leader in cloud controlled WiFi, routing and security, all managed from a centralized dashboard.
Cisco on Thursday informed customers that it has patched 34 high-severity vulnerabilities affecting its IOS and IOS XE software, including many that can be exploited remotely without authentication. The company has released a total of 25 advisories as part of the September 2020 semiannual IOS and IOS XE Software Security Advisory Bundled Publication.
SolarWinds announced an expansion of their monitoring capabilities within the Cisco Meraki Marketplace, which is now able to integrate the Cisco Meraki Dashboard API with SolarWinds N-central. "Cisco Meraki offers a comprehensive set of cloud solutions that give IT providers the opportunity to streamline and simplify the digital workplace, a goal that has never been more paramount as the definition of the workplace is in flux. Daily shifts from work from home and returning to the office require an elastic office space and IT infrastructure," said Mav Turner, group vice president of products for SolarWinds MSP. "This goal is fully aligned with SolarWinds MSP, as we work to empower MSPs to more easily fulfill a market need that has spiked almost overnight. As MSP customers seek their help more than ever, we believe the integration with Cisco Meraki and N-central will play another important role in supporting them."
Cisco Systems released a barrage of patches, Thursday, aimed at fixing bugs in the networking giant's ubiquitous IOS operating system. Twenty-nine of the Cisco bugs are rated high severity, with 13 rated medium in severity.
Penetration testing tool Cobalt Strike is increasingly being used by black hats in non-simulated attacks as traces show up in scenarios from ransomware infections to state-backed APT threats, says Cisco Talos. Claiming that the tool "Accounted for 66 per cent of all ransomware attacks Cisco Talos Incident Response responded to this quarter," the threat intel firm reckons that both criminal hackers and pentesting security analysts' red teams alike are making great use of Cobalt Strike, especially for its ability to deploy listeners on targeted networks.
Gigamon announced the integration of Gigamon ThreatINSIGHT and Cisco SecureX to optimize network security through accelerated threat detection and response. Simplified network security - incident responders will have the data they need to effectively manage threats within one unified interface with seamless integration, thus eliminating the challenges of hopping between multiple piecemeal security solutions.
Cisco last week released patches to address a critical remote code execution vulnerability in Jabber for Windows. "Cisco Jabber uses XHTML-IM by default for all messages. A malicious message can therefore easily be created by intercepting an XMPP message sent by the application and modifying it. Attackers can do this manually on their own machine or it can be automated to create a worm that spreads automatically," the company continues.
Researchers are warning of a critical remote code-execution flaw in the Windows version of Cisco Jabber, the networking company's video-conferencing and instant-messaging application. The flaw has a CVSS score of 9.9 out of 10, making it critical in severity, Cisco said in a Wednesday advisory.
Cisco has patched four vulnerabilities in its Jabber client for Windows, the most critical of which could allow attackers to achieve remote code execution by sending specially crafted chat messages. Cisco Jabber is a video conferencing and instant messaging application that's often used within enterprises for internal communication and collaboration.