複数の Cisco 製品に脆弱性

最終更新日: 2019/10/02

情報源

US-CERT Current Activity
Cisco Releases Security Advisories
https://www.us-cert.gov/ncas/current-activity/2019/09/26/cisco-releases-security-advisories

概要

複数の Cisco 製品には、脆弱性があります。結果として、遠隔の第三者が、任意のコマンドを実行したり、サービス運用妨害 (DoS) 攻撃を行ったりするなどの可能性があります。
Cisco IOS Software、Cisco IOS XE Software または Cisco IOx アプリケーション環境が動作する製品が対象となる可能性があります。
影響度 High の脆弱性情報に記載されている製品は次のとおりです。

– Cisco 1100、4200、および 4300 Series Integrated Services Routers (ISRs)
– Cisco Cloud Services Router (CSR) 1000V Series
– Cisco Enterprise Network Compute System (ENCS)
– Cisco Integrated Services Virtual Router (ISRv)
– Cisco Catalyst 4500 Supervisor Engine 6-E
– Cisco Catalyst 4500 Supervisor Engine 6L-E
– Cisco Catalyst 4900M Switch
– Cisco Catalyst 4948E Ethernet Switch
– Cisco Catalyst 4948E-F Ethernet Switch
– Cisco 800 Series Industrial Integrated Services Router
– Cisco 1000 Series Connected Grid Routers (CGR 1000)
– Cisco Unified Border Element (CUBE)
– Cisco Unified Communications Manager Express (CME)
– Cisco IOS Gateways with Session Initiation Protocol (SIP)
– Cisco TDM Gateways
– Cisco Unified Survivable Remote Site Telephony (SRST)
– Cisco Business Edition 4000 (BE4K)
– Cisco ASR 900 Series router
– Cisco 510 WPAN Industrial Router
– Cisco CGR 1000 Compute Module
– Cisco IC3000 Industrial Compute Gateway
– Cisco Industrial Ethernet 4000 Series Switches
– Cisco Catalyst 3850 Series
– Cisco Catalyst 9300 Series

※製品によって、影響を受ける条件が異なります。また、上記製品以外にも、影響度 Medium の複数の脆弱性情報が公開されています。詳細は、Cisco が提供する情報を参照してください。
この問題は、該当する製品を Cisco が提供する修正済みのバージョンに更新することで解決します。詳細は、Cisco が提供する情報を参照してください。

関連文書(英語)

Cisco Security Advisory

Cisco IOS XE Software NAT Session Initiation Protocol Application Layer Gateway Denial of Service Vulnerability

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-sip-alg

Cisco Security Advisory

Cisco Catalyst 4000 Series Switches TCP Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-cat4000-tcp-dos

Cisco Security Advisory

Cisco IOx for IOS Software Guest Operating System Unauthorized Access Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ios-gos-auth

Cisco Security Advisory

Cisco IOS XE Software Web UI Command Injection Vulnerabilities
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-webui-cmd-injection

Cisco Security Advisory

Cisco IOS and IOS XE Software Session Initiation Protocol Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-sip-dos

Cisco Security Advisory

Cisco IOS XE Software Raw Socket Transport Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-rawtcp-dos

Cisco Security Advisory

Cisco IOS XE Software Filesystem Exhaustion Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-iosxe-fsdos

Cisco Security Advisory

Cisco IOx Application Environment Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-iox

Cisco Security Advisory

Cisco IOS XE Software FTP Application Layer Gateway for NAT, NAT64, and ZBFW Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ftp

Cisco Security Advisory

Cisco IOS XE Software Unified Threat Defense Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-utd

Cisco Security Advisory

Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-iosxe-digsig-bypass

Cisco Security Advisory

Cisco IOS and IOS XE Software IP Ident Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-identd-dos

 


引用元:JPCERTコーディネーションセンター
「JPCERT/CC WEEKLY REPORT 2019-10-02」
https://www.jpcert.or.jp/wr/2019/wr193801.html