Vulnerabilidade “Shellshock” afeta produtos Cisco

Depois do Heartbeat é a vez do Shellshock deixar os administradores de redes e aplicações preocupados. Uma vasta lista de dispositivos que utilizam o Bash Shell do Unix, de diversas empresas, foram afetados.

O shell é como um mensageiro, facilitando a comunicação entre você e seu computador. É uma forma de você enviar os comandos ou requisições para o computador de uma forma que ele possa entender. Já o Bash é um shell básico, com poucos recursos, e apesar de não ser o shell padrão, ele está disponível em todos os sistemas Linux para compatibilidade com programas UNIX.

O Shellshock, também conhecido como Bashdoor, é um grupo de bugs de segurança, sendo o primeiro deles divulgado em 24 de setembro 2014. Essas vulnerabilidades permitem um invasor executar comandos, podendo até obter acesso administrativo do sistema.

Produtos Cisco afetados

A Cisco divulgou a lista de dispositivos afetados, não afetados e outros que estão sob investigação. Abaixo a lista dos produtos que possuem a vulnerabilidade.

Collaboration and Social Media

• Cisco WebEx Meetings Server (CWMS) [CSCur02916]

Meraki Products

• Cisco Enterprise Linux [CSCur05384]

Network Application, Service, and Acceleration

• Cisco ACE Application Control Engine Module for the Cisco Catalyst 6500 [CSCur02931]
• Cisco ASA CX and Cisco Prime Security Manager [CSCur01959]
• Cisco Application and Content Networking System (ACNS) [CSCur05564]
• Cisco GSS 4492R Global Site Selector [CSCur02747]
• Cisco NAC Appliance [CSCur03364]
• Cisco Sourcefire Defense Center and Sensor Products *See Details Section
• Cisco Visual Quality Experience Server [CSCur06775]
• Cisco Visual Quality Experience Tools Server [CSCur06775]
• Cisco Wide Area Application Services (WAAS) [CSCur02917]

Network and Content Security Devices

• Cisco Identity Services Engine (ISE) [CSCur00532]
• Cisco Intrusion Prevention System Solutions (IPS) [CSCur00552]
• Cisco IronPort Encryption Appliance [CSCur02831]
• Cisco NAC Guest Server [CSCur05629]
• Cisco Physical Access Gateway [CSCur05343]
• Cisco Physical Access Manager [CSCur05357]
• Cisco Secure Access Control Server (ACS) [CSCur00511]

Network Management and Provisioning

• Cisco Access Registrar Appliance Cisco Prime Access Registrar Appliance [CSCur10557]
• Cisco Digital Media Manager (DMM) [CSCur05123]
• Cisco Enterprise Content Delivery Service [CSCur02848]
• Cisco MXE Series [CSCur05088]
• Cisco Media Experience Engines (MXE) [CSCur05088]
• Cisco Prime LAN Management Solution [CSCur05125]
• Cisco Prime License Manager [CSCur05098]
• Cisco Prime Network Services Controller [CSCur05617]
• Cisco Quantum SON Suite [CSCur05662]
• Cisco Quantum Virtualized Packet Core [CSCur05662]
• Cisco Show and Share (SnS) [CSCur05123]
• Cisco UCS Central [CSCur05093]
• Cisco Unified Intelligence Center (CUIC) [CSCur02891]
• Data Center Analytics Framework (DCAF) [CSCur09685]
• Digital Media Manager (DMM) [CSCur03217]
• Local Collector Appliance (LCA) [CSCur05780]
• Network Configuration and Change Management [CSCur05794]

Routing and Switching – Enterprise and Service Provider

• Cisco ASR 5000 Series [CSCur05102]
• Cisco Application Policy Infrastructure Controller [CSCur01249]
• Cisco Connected Grid Routers (CGR) [CSCur04898]
• Cisco IOS-XE for ASR1k, ASR903, ISR4400, CSR1000v [CSCur02734]
• Cisco IOS-XE for Catalyst 3k, 4k, and AIR-CT5760 [CSCur03368]
• Cisco MDS [CSCur01099]
• Cisco Network Convergence System (NCS) 6000 [CSCur02177]
• Cisco Nexus 1000 Virtual Supervisor Module (VSM) [CSCur04438]
• Cisco Nexus 1010 [CSCur04510]
• Cisco Nexus 3000 / 3500 [CSCur05529]
• Cisco Nexus 4000 [CSCur05610]
• Cisco Nexus 5000/6000 [CSCur05017]
• Cisco Nexus 7000 Series Switches [CSCur04856]
• Cisco Nexus 7000 [CSCuq98748]
• Cisco Nexus 9000 [CSCur02102]
• Cisco Nexus 9000 running NxOS [CSCur02700]
• Cisco OnePK All-in-One VM [CSCur04925]
• Cisco Service Control Engine 1010 [CSCur05021]
• Cisco Service Control Engine 2020 [CSCur05021]
• Cisco Service Control Engine 8000 [CSCur05021]

Unified Computing

• Cisco Standalone rack server CIMC [CSCur03816]
• Cisco UCS Director [CSCur02877]
• Cisco UCS Invicta Appliance [CSCur05026]
• Cisco UCS [CSCur01379]
• Cisco Virtualization Experience Client 6215 [CSCur05844]

Voice and Unified Communications Devices

• Cisco Emergency Responder [CSCur05434]
• Cisco Hosted Collaboration Mediation Fulfillment [CSCur05477]
• Cisco IM and Presence Service (CUPS) [CSCur05454]
• Cisco IP Interoperability and Collaboration System (IPICS) [CSCur05245]
• Cisco MediaSense [CSCur02875]
• Cisco Paging Server (Informacast) [CSCur04834]
• Cisco Paging Server [CSCur04834]
• Cisco SocialMiner [CSCur02880]
• Cisco Unified Communications Domain Manager [CSCur01180]
• Cisco Unified Communications Manager (CUCM) [CSCur00930]
• Cisco Unified Contact Center Express (UCCX) [CSCur02861]
• Cisco Unity Connection (UC) [CSCur05328]

Video, Streaming, TelePresence, and Transcoding Devices

• Cisco AutoBackup Server [CSCur09315]
• Cisco D9036 Modular Encoding Platform [CSCur03243]
• Cisco D9036 Modular Encoding Platform [CSCur04504]
• Cisco Digital Media Players [CSCur05628]
• Cisco Download Server (DLS) (RH Based) [CSCur09318]
• Cisco Edge 300 Digital Media Player [CSCur02761]
• Cisco Edge 340 Digital Media Player [CSCur02751]
• Cisco PowerVu D9190 Conditional Access Manager (PCAM) [CSCur05774]
• Cisco Show and Share [CSCur03539]
• Cisco TelePresence Conductor [CSCur02103]
• Cisco TelePresence IP Gateway Series [CSCur04984]
• Cisco TelePresence ISDN Link [CSCur05025]
• Cisco TelePresence Manager (CTSMan) [CSCur05104]
• Cisco TelePresence Recording Server (CTRS) [CSCur05038]
• Cisco TelePresence TE Software (for E20 – EoL) [CSCur05162]
• Cisco TelePresence Video Communication Server (VCS/Expressway) [CSCur01461]
• Cisco TelePresence endpoints (C series, EX series, MX series, MXG2 series, SX series) and the 10″ touch panel [CSCur02591]
• Cisco Video Distribution Suite for Internet Streaming VDS-IS [CSCur05320]
• Cisco Video Surveillance Media Server [CSCur05423]
• Cisco Videoscape Distribution Suite Transparent Caching [CSCur06304]

Cisco Hosted Services

• Cisco Intelligent Automation for Cloud [CSCur05134]
• Cisco Proactive Network Operations Center [CSCur05856]
• Cisco Universal Small Cell CloudBase [CSCur05647]
• Cisco WebEx Node for MCS [CSCur07169]
• Web Element Manager [CSCur09009]
• WebEx PCNow [CSCur05742]
• WebEx QuickBooks [CSCur05740]

Outro equipamentos e software ainda estão sob investigação, e esta lista é atualizada periodicamente.

Mais informações neste link.

Até a próxima.