保安警报 (A19-08-07): Cisco产品多个漏洞

描述:

Cisco发布了安全公告以应对发现于Cisco IOS XE、NX-OS 及 FXOS软件中的多个漏洞。未获认证的远端攻击者可以向受影响系统发出特制的查询或封包，从而攻击这些漏洞。获认证的攻击者可以执行恶意指令、操纵远端管理连接或向受影响系统发出特制的SNMP封包，从而攻击这些漏洞。

受影响的系统:

• Cisco运行Cisco IOS XE 软件的产品
• Cisco运行Cisco NX-OS软件的产品
• Cisco运行Cisco FXOS 软件的产品

影响:

成功利用这些漏洞的攻击者可以在受影响的系统导致绕过认证、执行任意指令、权限提升、或服务受阻断。

建议:

适用于受影响系统的软件更新已可获取。受影响系统的系统管理员应遵从产品供应商的建议，立即采取行动以降低风险。有关修补程式的详细资料，请参阅供应商网站的相应安全公告中有关 “Fixed Software” 的部分。

系统管理员可联络其产品支援供应商，以取得修补程式及有关支援。

进一步信息:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-iosxe-rest-auth-bypass
https://tools.cisco.com/security/center/viewErp.x?alertId=ERP-72243
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-ucs-privescalation
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-memleak-dos
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-ipv6-dos
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-fsip-dos
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-fxnxos-snmp-dos
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-snmp-bypass
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-ntp-dos
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-api-dos
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nexus-aci-dos
https://www.hkcert.org/my_url/zh/alert/19082901
https://www.us-cert.gov/ncas/current-activity/2019/08/29/cisco-releases-security-updates-multiple-products
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1962 (to CVE-2019-1969)
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1977
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12643