Cisco patches critical flaws in DNA Center and Prime Infrastructure

Networking giant Cisco has released patches for several of its products, warning that the updates are for critical bugs found during internal testing.

Labeled CVE-2018-15379, a vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and have direct unauthorized access to critical management functions.

An insecure default configuration of the affected system can allow an attacker to exploit this vulnerability by directly connecting to the exposed services and retrieve and modify critical system files.

There are no workarounds that address this vulnerability, but Cisco has released software updates that address this vulnerability – specifically Cisco DNA Center Software Release 1.2 and later.

CVE-2018-0448 describes a vulnerability in the identity management service of Cisco DNA Center. Due to insufficient security restrictions for critical management functions, a remote attacker could bypass authentication and take complete control of identity management functions.

Like the previous vulnerability, this one also doesn’t have any workarounds. Cisco, however, has included a patch in Cisco DNA Center Software Release 1.1.4 and later.

Finally, CVE-2018-15379 designates a vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions. The flaw, if exploited, could allow an unauthenticated, remote attacker to upload an arbitrary file. And execute commands at the privilege level of the user prime.

Cisco has released both a workaround and an update to address the Prime Infrastructure flaw. The workaround goes as follows:

“The administrator can disable TFTP for Cisco PI by navigating in the web interface to Administration > Settings > System Settings > Server > TFTP. In Cisco PI, TFTP is used for internal operations such as image transfer, configuration, and archives. The administrator can instead use a secure protcotol such as Secure Copy Protocol (SCP) or SFTP for these functions.”

Cisco has issued several updates for PI users. However, not all of them address the flaw, while some installments (like  3.2 FIPS) have no updates available as of yet – hence the workaround. Those who discovered and reported this flaw to Cisco note that, from their assessment, the provided fix only partially addresses the problem.

Leave a Reply