Two major suppliers of IT applications are looking after vulnerabilities they’ve discovered. Microsoft Corp. will ship several critical patches to Internet Explorer next week, while Cisco Systems has just issued fixes and a workaround for three problems its found.
Computerworld U.S. reports that Microsoft (Nasdaq: MSFT) will release six security updates for all versions of Internet Explorer and nearly all editions of Windows that browser uses.
The fix goes back to the aging IE 6 on Windows Server 2003 and up to the current IE 11.
There will also be a critical patch for all client editions of Windows back to Vista and almost all versions of WinServer.
Meanwhile Cisco Systems Inc. has patched two of three vulnerabilities discovered in its Unified Communications Domain Manager, which lets enterprises manage UC applications from a single platform.
The company said this week exploiting either the privilege escalation or the default SSH key vulnerabilities may allow an attacker to execute arbitrary commands or obtain privileged access to a CDM system.
The SSH key vulnerability is due to the presence of a default SSH private key, Cisco said, which is stored in an insecure way on the system. “An attacker could exploit this vulnerability by obtaining the SSH private key. For example, the attacker might reverse engineer the binary file of the operating system. This will allow the attacker to connect by using the support account to the system without requiring any form of authentication. An exploit could allow the attacker to gain access to the system with the privileges of the root user.”
The privilege escalation vulnerability is due to improper implementation of authentication and authorization controls of the Administration GUI. An attacker could exploit this vulnerability by submitting a crafted URL to change the administrative credentials of a user. The attacker needs to be authenticated to the system or convince a valid user of the Administration GUI to click a malicious link.
Cisco (Nasdaq: CSCO) has issued a software update that addresses these two problems, which must be applied because workarounds aren’t available. The CDM platform software has to be upgraded to version 4.4.2, while the application software has be changed to version 8.1.4.
The third problem is what Cisco calls a BVSMWeb unuauthorized data manipulation vulnerability, for which administrators will have to use a workaround (click here) until a software fix is available.