Cisco warns of flaws in ACS product
629541
BOSTON - Networking equipment maker Cisco Systems Inc. warned customers about security holes in two products that provide user authentication and authorization services for network devices such as firewalls and routers.
169202
(InfoWorld) - Cisco announced a pair of additions to its Network Admission Control (NAC) product line on Monday, launching new tools that promise to extend the authentication system to a greater variety of devices and office environments. The introductions were timed to coincide with the start of the Security Standard Conference in Chicago, which is owned and operated by InfoWorld's parent company, IDG. They come hot on the heels of Cisco's late-August announcement that Intel will arm computers using its vPro and Centrino microprocessors with the ability to communicate their security posture to corporate networks, even before they have been booted up. Â  Cisco unveiled its Network Module for NAC, which will give customers the ability to implant the authentication system into the vendor's Integrated Services Router (ISR) hardware, along with its NAC Profiler, which is meant to allow users to monitor a greater number of non-PC devices using the security tools. Executives with the San Jose, Calif.-based company said the latest products evidence the company's ongoing work to mature NAC aggressively. "This is an announcement where you see things continue to develop, not only in terms of the types of things that NAC technologies can do, as was the case with the chipset interaction, but also in terms of addressing problems that everyone has, such as getting posture assessments for devices that don't run on Windows," said Brendan O'Connell, senior product manager for Cisco's Security Technology Group. "With the ISR module, we're giving customers the option to push NAC into the branch-office setting, which is something else customers have been asking us for," O'Connell said. "It's all about increasing NAC's ease-of-use and operability." While Cisco is widely credited with inventing NAC technology -- which is identified by other vendors by the more generic term "network access control," and is used to verify a device's identity and security standing as it attempts to connect to a network -- some industry watchers have criticized the manufacturer for not moving faster to introduce products such as its new releases. In addition to expanding the potential footprint of its NAC systems by driving the technology into its ISR hardware, which it has been selling to customers for over three years, Profiler addresses one of the primary security concerns raised with the authentication systems, namely, their ability to identify and monitor IP-connected devices other than desktop and laptop computers. Based on NAC's complexity, some companies have chosen to use branch offices or remote locations to test its impact and efficacy in the field before blending the tools into their central IT networks, Cisco officials said -- exactly the type of scenario the ISR module will seek to facilitate. The ability to add NAC via a blade in the ISR devices will also appeal to small and medium-size businesses (SMBs), the networking giant contends, as will the ability to license the technology for office settings with 50 to 100 users -- the smallest deployment alternative for the tools the vendor has offered to date. Cisco maintains that by offering NAC monitoring for IP-connected machines such as Voice-over-Internet-Protocol (VoIP) phones and networked printers, companies will no longer be forced to formulate complicated exceptions to test the devices. In adding direct hooks for such equipment into NAC, Cisco claims it has also addressed the perceived security loophole created by the need to create such exemptions, which some have said made it easier for attackers to defeat the authentication systems by spoofing such devices. "It's not just PCs that are connecting to the perimeter of a network where customers need to make these types of decisions, which has been sort of a hole for a while as it was cumbersome to do NAC securely for some of these other devices, and users didn't have much information at their fingertips when they could do it," O'Connell said. "In some customer deployments, over half of the devices on the network are IP phones today, so, Profiler is an important step forward in improving NAC's abilities to that end." Ladi Adefala, security practice manager for World Wide Technology, a St. Louis-based systems integrator that both uses and re-sells Cisco's NAC products, said the new products should help expand the technology's uptake in both larger and smaller customers. Many companies have been looking for ways to test NAC in smaller settings and then extend the tools to a wider set of users, making the Network Module product launch particularly important, he said. The Profiler will eliminate the need for IT shops and service providers like World Wide Technology to port NAC to phones and other devices, a time-consuming process, according to Adefala. Cisco has been actively marketing two approaches to NAC -- using its appliances to provide local protection on networks and also utilizing its top-down network-wide "framework" strategy. This has caused some customers to spend a long time deciding which route to go down, the expert say. However, Adefala contends that more companies are jumping further into NAC as Cisco's products become more mature. "There was some initial confusion with which way to go, but Cisco has been able to get most customers to begin considering it more closely, particularly by marketing the appliance as a one-stop shop for NAC," he said. "I think that will continue to be the case over the next year because of the type of announcements we're seeing here, and more integration with third-party products." One industry analyst echoed those comments, saying Cisco's is making "incremental improvements" with each NAC product release and likely growing its overall customer base for the tools. Cisco's move to launch the NAC Profiler directly addresses a "perceived shortcoming" of the systems in allowing more devices to be tested, while the Network Module will encourage broader deployment among large multinationals and among smaller firms, said Phil Hochmuth, analyst with Boston-based Yankee Group. "They're trying to fit in more places with both the switches and the framework. Obviously a lot more customers are using the [appliances] today because they are easier to deploy, but I think the framework will eventually appeal to some people," Hochmuth said. "They also have all these switches in place, and if they can harness that to sell NAC, that could be pretty powerful. "NAC remains complicated and Cisco has been guilty of playing both sides a bit with the two different approaches, but they know that if they can get customers to adopt it today with the appliances, the eventually might go for the network-wide approach," the analyst said.
508145
Third-quarter figures showing Cisco Systems continues to lose ground may be due to rough product transition.
320458
Web servers may be vulnerable to attack, security company warns.
435804
Cisco Systems this week issued four security alerts, including two yesterday that outlined serious vulnerabilities in its appliances, routers and switches.
646043
Cisco Systems today is unveiling nine new software and hardware products, and upgrades to protect corporate computer networks from hackers and other Internet threats.
328112
The ground rules of the tests of Cisco and Avaya systems.
11292
Secunia has found that the number of security bugs in the open source Red Hat Linux operating system and Firefox browsers far outstripped comparable products from Microsoft last year.In a report released this week, Secunia also criticized CA for the quality of the code in its anti-virus products, saying that "inherent" code problems are exposing CA products to ongoing security vulnerabilities.On the other hand, "zero-day" security bugs in Firefox were patched more quickly than in Microsoft Internet Explorer, according to the Secunia 2007 Report, released this week.In a review of the number of vulnerabilities found in enterprise anti-virus vendors' products, Secunia found that CA was by far the leader, with 187 vulnerabilities, followed by Symantec with 73. Trend Micro (34), ClamAV (15), McAfee (13) and F-Secure (6) ranked lower on the list.The high figures for Symantec and CA are partly due to their wide range of products, some of which cover areas other than anti-virus, Secunia said.However, the majority of the CA bugs were due to "inherent code problems with some CA products", Secunia said in the report.Of particular concern is CA's range of ARCServe Backup products for laptops and desktops, which Secunia submitted to its Binary Analysis process after several bugs were reported and fixed. The bugs involved errors in processing particular arguments and requests.The analysis found that about 60 reported bugs were still present in the supposedly patched versions.What's more, the analysis found that the vulnerabilities were partly due to "the nature of the product code itself", Secunia said."Unless an overhaul of the code is undertaken, then the product remains susceptible to similar types of vulnerabilities," Secunia said.However CA said in a statement that it has rigorous quality-control measures in place for its software and continues to improve those measures.A number of the vulnerabilities found in Symantec products were due to their use of vulnerable software from third-party developers, Secunia said.One of these is the Autonomy Keyview SDK (software development kit), used in Symantec Mail to view Lotus 1-2-3 files. The component was reported to have a "highly critical" flaw on 12 December, but hasn't yet been patched, leaving some Symantec products vulnerable.Symantec said in a statement that it has published instructions for mitigating the problem and has issued product updates for some affected vendors. IBM, whose Lotus Notes was also affected by the Autonomy bug, has issued its own patch.Operating systems and browsersOut of the operating systems monitored by Secunia -- Windows (98 and onwards), Mac OS X, HP-UX 10.x and 11.x, Solaris 8, 9, and 10 and Red Hat (excluding Fedora) -- Red Hat was found to have by far the most vulnerabilities, at 633, with 99 percent found in third-party components. (Linux distributions are generally composed mostly of third-party software, which is integrated by the distributor.)Red Hat has taken issue with the figures, claiming the accurate number should be 404 vulnerabilities for last year.Solaris came next, with 252 bugs, 80 percent of which were in third-party components. Mac OS X came after that with 235, 62 percent of which were third-party.Windows had only 123 bugs reported, but 96 percent of those were found in the operating system itself. HP-UX had 75 bugs reported, 81 percent of which were in third-party code.Last week, a US Department of Homeland Security (DHS) bug-fixing scheme uncovered an average of one security glitch per 1,000 lines of code in 180 widely used open source software projects.The large number of Red Hat flaws is partly due to the large number and wide variety of components it includes."Red Hat contains two different browsers and graphic interfaces, a number of PDF readers and image editors, and so on," the report said. "Red Hat, HP-UX, and Solaris can easily be used as servers, and as such include and support a large number of third party components, while the same cannot be said of all versions of Windows and Mac OS X."Any consideration of relative OS security should look at factors not covered by the report, such as average patching time for vulnerabilities, Secunia said.In the browser field, Firefox led the way with 64 bugs, compared to 43 for Internet Explorer, and 14 each for Opera and Safari.However, in an examination of zero-day flaws - reported by third parties before a patch was available - Secunia found that Firefox tended to get more patches, sooner, compared to IE.Out of eight zero-day bugs reported for Firefox in 2007, five have been patched, three of those in just over a week. Out of 10 zero-day IE bugs, only three were patched and the shortest patch time was 85 days.ActiveX was hit by the largest number of browser add-on bugs in 2007, with 339 (compared to 45 last year), Secunia said.The figure was propped up by the Month of ActiveX Controls Bugs in May 2007, and by Secunia's discovery of a vulnerable ActiveX component that was used in 40 different products.QuickTime followed with 35 bugs and Java with 21 bugs.
611792
US-CERT has issued an alert citing several security flaws in Oracle products that could be used to shut down or take control of vulnerable systems or to corrupt or steal data from Oracle databases.
407536
The sourcecode to Ciscoâs industry leading PIX firewall system was recently stolen and put up for sale by malicious hackers under the guise of âThe Source Code Clubâ.
496030
Ability to change the settings of poorly configured home routers could put home networks at risk of serious attack.
623553
(InfoWorld) - Security researchers and experts this week cautioned network administrators to consider carefully whether they need to implement network access control (NAC) technology in their security infrastructure before buying in to the current hype surrounding it. Speaking on a panel at the Interop New York conference Josh Corman, host protection architect for Internet Security Systems, said that a company should have good reason to implement NAC, not just purchase the technology because it's the latest "buzzword" in the industry. "Do you want NAC because you heard itâs important or do you have real business problems to solve?" he said. NAC allows companies to perform health checks on end-point devices such as PCs and mobile devices before they are granted access to company networks. For example, employee PCs might be checked to make sure they are not infected with a virus and have up-to-date antivirus definitions before being allowed onto a corporate LAN. Corman was joined on the panel by Mike McKinnon, American director of security for Hewlett-Packard's ProCurve networking business; Elliott Glazer, direct of security architecture and consulting for Depository Trust and Clearing Organization; and Paul Stamp, a security analyst with Forrester Research. Speaking from a customer perspective, Glazer said he is more concerned at the moment with making sure the network infrastructure in his company itself is secure before worrying about how that network can check on the health of devices coming on to the network. "One of the fundamental things that has to be considered when you think about NAC is, is the network secure enough?" he said. "When I look at NAC, I say it's a great thing to do, but what do I do when someone comes in with a new piece of hardware -- what's it going to do to my network? Before I go down a NAC path, I'm going to make sure there is a secure environment there for me." "There's a lot of great stuff about NAC, but for us it's a little early," Glazer said. Forrester's Stamp said that for NAC to work effectively, companies involved in providing network security and those developing client technology must work together to make sure the networks can communicate effectively with endpoint devices. "[In NAC] it is the client-based technologies that are giving us the information, it is the client-based technologies that have to deal with any of the problems that arise," he said. "We as security are setting the policies, but the policies are taken into actionable rules by endpoint people. We have to be open to that and help them out. ... We really have to embrace the involvement of the endpoint guys."
41686
SAN JOSE, Calif. -- Cisco SystemsÃ¢ today announced a new line of integrated services routers, the industryâs first routers to deliver secure, wire-speed data, voice, video and other advanced services to
620504
Symantec, a leading computer system security provider ahs warned its customers of some serious flaws in the Windows operating system.
680401
Cisco systems Inc. has teamed up with Cognio Inc. on a system designed to ferret out the source of radio frequency noise that can interfere with WiFi networks.
2961
Secunia has posted a vulnerability marked as "highly critical" for users of any of the Avaya products that use PHP:   Avaya has acknowledged some vulnerabilities in various Avaya products, where some have unknown impacts and others can be exploited by malicious users to bypass certain security restrictions and potentially by malicious people to compromise a vulnerable system.   The following products are affected:   Avaya Communication Manager (CM 4.0 and CM 2.x prior to load 127.0) Avaya CCS/SES (CCS/SES 3.1.1) Avaya AES (AES 4.0)   Currently, according to the original announcement from Avaya, there are two issues that have been found and are able to be exploited - an issue with the xmlrpc extension and a problem with the ftp extension. Currently, there is no patch to correct these issues, but you can keep track of their current status via their entries
567864
As you spring forward this year, brace yourself for a software glitch that could affect computers, digital watches and clocks. By the Associated Press.