保安警報 (A18-03-07): Cisco 產品多個漏洞 (2018年3月)

描述:

Cisco 發布了20個安全公告，以應對發現於 Cisco IOS及IOS XE軟件中的多個漏洞，當中有3個公告被評級為嚴重，17個公告被評級為高級。未經授權的遠端攻擊者可以使用沒有記載的管理帳戶及預設的憑證資料登入受影響的裝置。攻擊者也可向受影響裝置傳送特製的封包求來攻擊這些漏洞。

受影響的系統:

• 所有運行Cisco IOS及IOS XE軟件的Cisco產品

影響:

成功利用這些漏洞可以導致執行任意程式碼、系統重啓、服務受阻斷、權限提升或控制受影響的系統，視乎攻擊者利用哪個漏洞而定。

建議:

適用於受影響系統的修補程式已可獲取。受影響系統的用戶應遵從產品供應商的建議，立即採取行動以降低風險。有關修補程式的詳細資料，請參閱供應商網站的相應安全公告中有關 “Fixed Software” 的部分。

用戶可聯絡其產品支援供應商，以取得修補程式及有關支援。

進一步資訊:

https://tools.cisco.com/security/center/viewErp.x?alertId=ERP-66682
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-bfd
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr1
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr2
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr3
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dos
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-fwip
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-igmp
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ike
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ike-dos
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ipv4
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-lldp
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-opendns-dos
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-privesc1
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-qos
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-snmp
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-snmp-dos
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-xepriv
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-xesc
https://www.us-cert.gov/ncas/current-activity/2018/03/28/Cisco-Releases-Security-Updates
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0150 (to CVE-2018-0152)
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0154 (to CVE-2018-0161)
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0165
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0167
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0169 (to CVE-2018-0177)