Threat Level: green Handler on Duty: Bojan Zdrnja

SANS ISC: Cisco content switch SSL vulnerability SANS ISC InfoSec Forums

Special Webcast: What you need to know about the crypt32.dll vulnerability. Register Now

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Cisco content switch SSL vulnerability
Cisco announced a vulnerability in the 11500 and 11501 content switches with the optional SSL module.
http://www.cisco.com/warp/public/707/cisco-sn-20050908-css.shtml

The scope appears to be limited. You must be using certificate authentication and the CSS must be the SSL server. In the affected cases if ssl fails to renegotiate a session at the appropriate time it may be possible to bypass authentication. Those using SSL are strongly encouraged to upgrade as soon as possible.
Dan

42 Posts

Sign Up for Free or Log In to start participating in the conversation!