7 ms·

ArsTechnica article as of this posting: >Cisco Systems said that more than 300 models of switches it sells contain a critical vulnerability that allows the CIA

ArsTechnica article as of this posting: >Cisco Systems said that more than 300 models of switches it sells contain a critical vulnerability that allows the CIA to use a simple command to remotely execute malicious code that takes full control of the devices. There currently is no fix. Text on Cisco Support Site linked on ArsTechnica: >This vulnerability affects the following Cisco devices when running a vulnerable Cisco IOS software release and configured to accept incoming Telnet connections: [Models list] Put aside for a moment the 'desireability' of the outcome, but from what I gather on Cisco's site, by turning off incoming Telnet connections, the vulnerability can be fixed. I'm rather confused about this.

tvon 10y ago
Disabling the service is a way to protect you from the vulnerability, but it is not a fix for the vulnerability. A fix for the vulnerability would allow you to continue using the service.
- cortesoft 10y ago
  Right? We have issued a fix for the router - simply unplug all network cables from the router, and you are no longer vulnerable.
- chousuke 10y ago
  The article kind of makes it sound like telnet is somehow necessary and that disabling it hasn't been a best practice for years. Maybe there are still old devices that don't support SSH and you literally have no option, but really, what other reason is there to have telnet enabled?
  - 6stringmerc 10y ago
    That's what I was thinking about. On the Cisco support site Telnet gets barely a mention. It is apparently not the flagship feature of these switches and whatnot. Okay maybe it's customary to leave it open but there's a lot of lazy practices that result in bad security, not just headline "vulnerabilities" that affect - gasp - 300+ models! So, basically I think Ars Technica's sub-par quality strikes again, in that a tech site gets a fundamental understanding of technology wrong. If something isn't mission critical, can be turned off, and alleviates a vulnerability, then that's a way to fix it. Plain fucking English.
    - peterwwillis 10y ago
      No, that is a workaround. Telnet is still broken until they patch the security hole.
  - rbanffy 10y ago
    Please, use an RPi attached to a serial port and SSH through it.
e12e 10y ago
Heh, telnet. Reminds me of: http://m.slashdot.org/story/80056 http://m.slashdot.org/story/80056 "(...) vulnerability in Solaris 10 and 11 telnet that allows anyone to remotely connect as any account, including root, without authentication. Remote access can be gained with nothing more than a telnet client. More information and a Snort signature can be found at riosec.com. Worse, this is almost identical to a bug in AIX and Linux rlogin from way back in 1994." February of 2007
mtve 10y ago
i wonder, is it that century old regex bug?

tvon 10y ago

Disabling the service is a way to protect you from the vulnerability, but it is not a fix for the vulnerability. A fix for the vulnerability would allow you to continue using the service.

cortesoft 10y ago
Right? We have issued a fix for the router - simply unplug all network cables from the router, and you are no longer vulnerable.
chousuke 10y ago
The article kind of makes it sound like telnet is somehow necessary and that disabling it hasn't been a best practice for years. Maybe there are still old devices that don't support SSH and you literally have no option, but really, what other reason is there to have telnet enabled?
- 6stringmerc 10y ago
  That's what I was thinking about. On the Cisco support site Telnet gets barely a mention. It is apparently not the flagship feature of these switches and whatnot. Okay maybe it's customary to leave it open but there's a lot of lazy practices that result in bad security, not just headline "vulnerabilities" that affect - gasp - 300+ models! So, basically I think Ars Technica's sub-par quality strikes again, in that a tech site gets a fundamental understanding of technology wrong. If something isn't mission critical, can be turned off, and alleviates a vulnerability, then that's a way to fix it. Plain fucking English.
  - peterwwillis 10y ago
    No, that is a workaround. Telnet is still broken until they patch the security hole.
- rbanffy 10y ago
  Please, use an RPi attached to a serial port and SSH through it.

e12e 10y ago

Heh, telnet. Reminds me of: http://m.slashdot.org/story/80056 http://m.slashdot.org/story/80056 "(...) vulnerability in Solaris 10 and 11 telnet that allows anyone to remotely connect as any account, including root, without authentication. Remote access can be gained with nothing more than a telnet client. More information and a Snort signature can be found at riosec.com. Worse, this is almost identical to a bug in AIX and Linux rlogin from way back in 1994." February of 2007

mtve 10y ago

i wonder, is it that century old regex bug?