lolloj - Fotolia
Critical Cisco vulnerabilities patched in Policy Suite
News roundup: Critical Cisco vulnerabilities in Policy Suite products were patched this week. Plus, Venmo's API is set to public, exposing a trove of customer data, and more.
Cisco disclosed and patched a handful of critical and high-severity vulnerabilities in its products this week.
The company fixed four critical vulnerabilities in its Policy Suite: Two are flaws that enabled remote unauthenticated access to the Policy Builder interface; one flaw is in the Open Systems Gateway initiative (OSGi) interface; and the last is in the Cluster Manager.
A successful exploit of one of the critical Cisco vulnerabilities in Policy Builder -- tracked as CVE-2018-0374 -- gave attackers access to the database and the ability to change any data in that database. The other vulnerability in the Policy Builder interface -- tracked as CVE-2018-0376 -- could have enabled an attacker to change existing repositories and create new repositories through the interface.
The third critical vulnerability could have enabled an attacker to directly connect to the OSGi interface remotely and without authentication. Once exploited, an attacker could have accessed or changed any files accessible by the OSGi process.
The last of the critical Cisco vulnerabilities -- CVE-2018-0375 -- was in the Cluster Manager of Cisco Policy Suite. With this flaw, an attacker could have logged in to remotely use the root account, which has static default credentials, and execute arbitrary commands.
The Cisco Policy Suite manages policies and subscriber data for service providers by connecting to network routers and packet data gateways.
The Cisco vulnerabilities affected Policy Suite releases prior to 18.2.0. The Cisco Product Security Incident Response team has already patched the vulnerabilities and has not seen any exploits in the wild.
Cisco also disclosed and patched seven high-severity flaws in its software-defined WAN (SD-WAN) products, though only one of them can be exploited remotely and without authentication -- unlike the four critical vulnerabilities. One vulnerability requires authentication and local access to successfully exploit, but the others only needed authentication to be successfully exploited.
The SD-WAN vulnerabilities gave attackers the ability to overwrite arbitrary files on the operating system and execute arbitrary commands. One was a zero-touch denial-of-service vulnerability, and there were four command injection vulnerabilities.
The company also patched a high-severity denial-of-service vulnerability in the Cisco Nexus 9000 Series Fabric Switches, as well as 16 other medium-severity issues in a variety of its other products.
In other news:
- Venmo, the mobile payment app owned by PayPal, has its API set to public by default and is exposing user data. According to researcher Hang Do Thi Duc, if a Venmo user accepts the default settings on their account, their transaction details are publicly accessible through the API. "It's incredibly easy to see what people are buying, who they're sending money to, and why," Do Thi Duc said in a blog post. She noted that she was able to gather data on cannabis retailers, lovers' quarrels and the unhealthy eating habits of users -- along with their identifying information. Do Thi Duc was able to gather all of this and more by perusing the public Venmo API and looking specifically at the 207,984,218 transactions left accessible to the public in 2017. "I think it's problematic that there is a public feed which includes real names, their profile links (to access past transactions), possibly their Facebook IDs and essentially their network of friends they spend time with," she wrote. "And all of this is so easy to access! I believe this could be designed better."
- Multinational telecommunications company Telefonica suffered a data breach that exposed the data of millions of customers. Spanish users of Telefonica's Movistar telecommunication services may have had their personal and financial information exposed because of the breach, including phone numbers, full names, national ID numbers, addresses, banking information, and call and data records. The breach was discovered after a Movistar user reported it to FACUA, a Spanish consumer rights nonprofit. Because of a design flaw in the Movistar online portal, anyone with a Movistar account could access other users' data. FACUA notified Telefonica of the breach, and the company responded the next day, at which point FACUA made a public disclosure.
- Oracle's July Critical Patch Update (CPU) patched 334 security vulnerabilities, including 61 critical flaws, across many of its products. The most vulnerable affected product is the Oracle Financial Services application, which has 56 vulnerabilities -- 21 of which can be exploited over the network without authentication. The vulnerabilities with the highest severity ratings -- with a CVSS score of 9.8 -- are in Oracle's Financial Services, Fusion Middleware, PeopleSoft, E-Business Suite, retail applications and others. Over 200 vulnerabilities noted in the Oracle CPU affected business-critical applications. This month's CPU has the highest number of patches at 334; the runner-up was 308 patches in July 2017.
