Vulnerabilities Found In IBM Lotus Sametime And Cisco Gear

Cisco alerted users to vulnerabilities in several of its products while IBM says it has a patch ready for its software.

Thomas Claburn, Editor at Large, Enterprise Mobility

May 23, 2008

1 Min Read

US-CERT has posted warnings about security vulnerabilities in IBM Lotus Sametime software and Cisco IOS Secure Shell, Service Control Engine, and Voice Portal.

The IBM Lotus Sametime vulnerability was reported to IBM by security vendor Tipping Point on Dec. 11, 2007. IBM and Tipping Point have released information about the flaw now that IBM has a patch ready.

The Sametime vulnerability could allow a remote attacker to execute malicious code without authentication. According to Tipping Point, there's a flaw in the way that the Community Services Multiplexer (StMux.exe) handles long URLs. A maliciously crafted URL could be passed into a vulnerable sscanf() function, causing a stack overflow.

IBM says that the issue has been fixed in Sametime 8.0.1 and in hotfix ICAE-7DPP83 for Sametime 7.5.1 Cumulative Fix 1 (CF1).

Cisco on Wednesday reported vulnerabilities in its IOS Secure Shell, Service Control Engine, and Voice Portal.

"The server side of the SSH implementation in Cisco IOS contains multiple vulnerabilities that allow an unauthenticated user to generate a spurious memory access or, in certain cases, reload the device," Cisco explains in an advisory. "If the attacker is able to reload the device, these vulnerabilities could be repeatedly exploited to cause an extended Denial of Service (DoS) condition."

The Cisco Service Control Engine (SCE) contains three independent SSH vulnerabilities that could result in system instability or a reload of the SCE, according to Cisco.

And the Cisco Voice Portal contains a vulnerability that could allow a user with administrator privileges to create a superuser account with even more extensive privileges.

US-CERT advises Cisco customers to review the company's advisories and determine whether software fixes or workarounds are available.

About the Author(s)

Thomas Claburn

Editor at Large, Enterprise Mobility

Thomas Claburn has been writing about business and technology since 1996, for publications such as New Architect, PC Computing, InformationWeek, Salon, Wired, and Ziff Davis Smart Business. Before that, he worked in film and television, having earned a not particularly useful master's degree in film production. He wrote the original treatment for 3DO's Killing Time, a short story that appeared in On Spec, and the screenplay for an independent film called The Hanged Man, which he would later direct. He's the author of a science fiction novel, Reflecting Fires, and a sadly neglected blog, Lot 49. His iPhone game, Blocfall, is available through the iTunes App Store. His wife is a talented jazz singer; he does not sing, which is for the best.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights