Cisco Releases IOS Bundle of Vulnerabilities ：SANS Internet Storm Center; Cooperative Network Security Community - Internet Security - isc（情報元のブックマーク数）

Ciscoから多数のセキュリティアドバイザリが出ています。

Cisco has officially released a "bundle" of vulnerability notices for their IOS software. The issues related to these notifcations are varied and relate to TCP, UDP, Mobile and VPN vulnerabilities. We are reviewing them now and thought you may want to do the same.

• Cisco IOS cTCP DoS Vulnerability
• Cisco IOS Multiple Features IP Sockets Vulnerability
• Cisco IOS Mobile IP and Mobile IPv6 Vulnerabilities
• Cisco IOS Secure Copy Privilege Escalation Vulnerability
• Cisco IOS Session Initiation Protocol DoS Vulnerability
• Cisco IOS Multiple Features Crafted TCP Sequence Vulnerability
• Cisco IOS Multiple Features Crafted UDP Packet Vulnerability
• Cisco IOS WebVPN and SSLVPN Vulnerabilities

InfoSec Handlers Diary Blog - Cisco Releases IOS Bundle of Vulnerabilities

• Cisco IOS Software Multiple Features Crafted UDP Packet Vulnerability
  • http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90426.shtml
• Cisco IOS Software Multiple Features Crafted TCP Sequence Vulnerability
  • http://www.cisco.com/en/US/products/products_security_advisory09186a0080a904cb.shtml
• Cisco IOS Software Multiple Features IP Sockets Vulnerability
  • http://www.cisco.com/en/US/products/products_security_advisory09186a0080a904c6.shtml
• Cisco IOS Software WebVPN and SSLVPN Vulnerabilities
  • http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90424.shtml
• Cisco IOS Software Mobile IP and Mobile IPv6 Vulnerabilities
  • http://www.cisco.com/en/US/products/products_security_advisory09186a0080a9042f.shtml
• Cisco IOS Software Secure Copy Privilege Escalation Vulnerability
  • http://www.cisco.com/en/US/products/products_security_advisory09186a0080a904c8.shtml
• Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability
  • http://www.cisco.com/en/US/products/products_security_advisory09186a0080a904c0.shtml
• Cisco IOS cTCP Denial of Service Vulnerability
  • http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90459.shtml

US-CERTも回避策かアップデートを適用した方が良いよって言っています。

US-CERT encourages users and administrators to review the following Cisco security advisories and apply any necessary workarounds or updates to help mitigate the risks.

http://www.us-cert.gov/current/index.html#cisco_releases_multiple_security_advisory

これって結構危険だよねぇ・・・ねぇ。

同日公開したセキュリティアドバイザリーは8件。いずれもCisco IOS Softwareの脆弱性に対処している。脆弱性を突かれると、サービス妨害（DoS）、ネットワークトラフィックへの干渉、権限昇格、情報流出などにつながる恐れがある。
共通指標のCVSSによる深刻度評価スコアは、最も高いもので9.0（最大値は10.0）。Ciscoはそれぞれの脆弱性を解決するソフトウェアアップデートの適用を呼びかけている。

Cisco、IOSのセキュリティアップデートを公開 - ITmedia エンタープライズ

関連記事

• Cisco IOS Mobile IP/Mobile IPv6 Multiple Denial of Service Vulnerablities
• シスコ、IOSの脆弱性を修正する8件のアップデート情報を公開 : セキュリティ - Computerworld.jp
• DoSや権限昇格の脆弱性：Cisco、IOSのセキュリティアップデートを公開 - ITmedia エンタープライズ