Vulnerabilities Found In IBM Lotus Sametime And Cisco Gear

US-CERT has posted warnings about security vulnerabilities in IBM Lotus Sametime software and Cisco IOS Secure Shell, Service Control Engine, and Voice Portal.

The IBM Lotus Sametime vulnerability was reported to IBM by security vendor Tipping Point on Dec. 11, 2007. IBM and Tipping Point have released information about the flaw now that IBM has a patch ready.

The Sametime vulnerability could allow a remote attacker to execute malicious code without authentication. According to Tipping Point, there's a flaw in the way that the Community Services Multiplexer (StMux.exe) handles long URLs. A maliciously crafted URL could be passed into a vulnerable sscanf() function, causing a stack overflow.

IBM says that the issue has been fixed in Sametime 8.0.1 and in hotfix ICAE-7DPP83 for Sametime 7.5.1 Cumulative Fix 1 (CF1).

Cisco on Wednesday reported vulnerabilities in its IOS Secure Shell, Service Control Engine, and Voice Portal.

"The server side of the SSH implementation in Cisco IOS contains multiple vulnerabilities that allow an unauthenticated user to generate a spurious memory access or, in certain cases, reload the device," Cisco explains in an advisory. "If the attacker is able to reload the device, these vulnerabilities could be repeatedly exploited to cause an extended Denial of Service (DoS) condition."

The Cisco Service Control Engine (SCE) contains three independent SSH vulnerabilities that could result in system instability or a reload of the SCE, according to Cisco.

And the Cisco Voice Portal contains a vulnerability that could allow a user with administrator privileges to create a superuser account with even more extensive privileges.

US-CERT advises Cisco customers to review the company's advisories and determine whether software fixes or workarounds are available.