Connect with us

Cars

Cisco’s warning: Patch now, critical SSH flaw affects Nexus 9000 fabric switches

Published

on

Cisco: DNS attacks will undermine trust in the internet
Sophisticated hacking group taps wide set of vulnerabilities as part of their global hacking spree.

Cisco has revealed that its Nexus 9000 fabric switches have a critical flaw that could allow anyone to remotely connect to a vulnerable device using Secure Shell (SSH) and control it with root user privileges.

The company disclosed the bug on Tuesday and has given it a severity rating of 9.8 out of 10. 

The issue stems from SSH key management in the Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software. Cisco mistakenly put a default SSH key pair in the devices that an attacker could grab by connecting to the device over IPv6.

“An attacker could exploit this vulnerability by opening an SSH connection via IPv6 to a targeted device using the extracted key materials. An exploit could allow the attacker to access the system with the privileges of the root user,” Cisco explains, noting it can’t be exploited over IPv4.  

SEE: 10 tips for new cybersecurity pros (free PDF)

The bug was found by external security researcher Oliver Matula from ERNW Enno Rey Netzwerke. 

There are no workarounds, so Cisco is encouraging customers to update the software. 

The bug affects the 9000 Series Fabric Switches in ACI mode if it is running Cisco NX-OS Software release before 14.1(1i).  

Cisco has fixes available for several other vulnerabilities acting the Nexus 9000 software, all of which affect systems running Cisco NX-OS Software release prior to 14.1(1i)  

ERNW’s Matula also reported a medium-severity path traversal flaw in the Nexus 9000 ACI mode software that would allow a local attacker with valid credentials to use ‘symbolic links’ to overwrite potentially sensitive system files.   

Another fix in Cisco NX-OS Software 14.1(1i) is a high-severity elevation of privilege flaw that allowed a local attacker with valid admin credentials for a device to execute arbitrary NX-OS commands as the root user. 

“The vulnerability is due to overly permissive file permissions of specific system files. An attacker could exploit this vulnerability by authenticating to an affected device, creating a crafted command string, and writing this crafted string to a specific file location,” Cisco explains.  

Pre-14.1(1i) NX-OS also wasn’t properly validating TLS client certificates sent between components of an ACI fabric. 

An attacker with a certificate that is trusted by the Cisco Manufacturing certificate authority and the corresponding private key could present a valid certificate while attempting to connect to the targeted device.  

“An exploit could allow the attacker to gain full control of all other components within the ACI fabric of an affected device,” Cisco notes. 

More on Cisco and security

Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Cars

Check out the 2+2 Chevrolet Corvette that never was

Published

on

The 60s was an iconic era in the automotive realm in the United States, with some incredibly popular cars getting their start then Vehicles like the Ford Mustang, Chevrolet Camaro, Chevrolet Corvette, and Dodge Charger, to name a few. Sometimes it takes one vehicle to change the industry and spawn many similar products from the other automakers. Case in point is Ford and its Mustang, which kicked off the pony car era eliciting responses with other iconic vehicles.

Another of the iconic Ford vehicles in the era that sold extremely well was the Thunderbird. The Thunderbird routinely outsold the Chevrolet Corvette. Early in its production, the Thunderbird was a two-seat sports car very similar to the Corvette. It grew in later generations, becoming a 2+2, offering a back seat to carry more passengers. The vehicle in the image above looks like the iconic 60s split-window Corvettes that are so valuable today, but there’s a key difference.

The difference is readily apparent when you look at the side view image in the Instagram post below, where General Motors Design shared photos of a one-off design buck. A design buck is essentially the shell of the vehicle used by automotive designers of the day to get the vehicle’s design just right. This particular example was never powered and never cruised the streets.

The car was a response to the Thunderbird, adding backseats to the Corvette in 1962. Sadly, the 2+2 Corvette was never built, and reports indicate the design buck was later crushed. Another interesting tidbit is that GM reportedly brought in a Ferrari to help with the styling and proportions of the car.

As for what finally became of the project, a GM executive named Bunkie Knudsen, who was part of the styling team but wasn’t a fan of the project, reportedly worked to get the project scrapped. He believed it would taint the Corvette brand and wouldn’t sell in large enough numbers to justify building it. The only Corvettes ever sold by GM have all been two-seat sports cars.

Continue Reading

Cars

Alpha Motors Superwolf is a completely decked out electric pickup

Published

on

Alpha Motors unveiled a new version of its all-electric pickup called the Superwolf. The difference between this particular version of the truck and the ones that have been shown before is that the Superwolf is completely decked out with all sorts of accessories you might expect to find only on the aftermarket. One of the more interesting accessories seen on the truck is tube doors similar to what you commonly see on Jeeps.

Superwolf also has custom KMC wheels with large off-road tires, a custom front bumper with tow rings and skid plates, as well as a complete roof rack featuring an LED light bar and large locking case. In the bed of the truck is a rack that adds more style to the truck and supports the roof basket.

Under the doors are also compact step rails that look like they are intended to protect the vehicle’s body while off-roading. The truck also features wide fender flares and looks fantastic in general. Other interesting features of the truck include a bed cover that appears to be made out of aluminum and a rack that spans the bed allowing for items to be attached on top of the bed itself.

Several other accessories are available for the truck, including a bed extension and more. Other than the accessories, Superwolf features a driving range of up to 300 miles per charge. It has two motors for four-wheel drive and can reach 60 mph in 6.5 seconds. The truck has a tow rating of 6724 pounds and features a rapid charger with battery cooling and heating.

The truck’s interior can hold four passengers and has a digital display for the driver along with the wide-format center display. Bluetooth connectivity and premium sound are also featured. Superwolf can be reserved now with a starting MSRP listed at between $48,000 and $56,000.

Continue Reading

Cars

Classic 1967 Chevrolet Camaro Z/28 Trans Am racer heads to auction

Published

on

When it comes to muscle cars of the 60s, one of the most iconic is the Chevrolet Camaro. The value of a normal Chevrolet Camaro from the era is often very high. The value of this 1967 Chevrolet Camaro Z/28 Trans Am is even higher as it’s an actual successful racing car from the era. This vehicle is the first of six Sunoco Trans Am Camaros that Penske Racing built.

This particular car has an extensive racing history with drivers Mark Donohue and George Follmer behind the wheel. The car has been completely restored by Kevin McKay in its iconic Sunoco racing livery. The car is said to be one of the most significant Chevrolet-powered racing cars ever built. Because of its rarity and racing pedigree, the car is expected to bring as much as $2 million at auction in Pebble Beach.

The car features a 302 cubic inch overhead valve V-8 engine and a single four-barrel carburetor. It’s estimated to produce 450 horsepower and has a four-speed manual gearbox along with four-wheel hydraulic disc brakes. The front suspension is independent wishbone with coil springs, while the rear has a live axle with leaf springs, a setup common in the era.

The racing series the car was built for required a 302 cubic-inch engine. The Z/28 was born due to the need to produce examples for homologation. The Z/28 became the Camaro performance production model, with 602 examples being built in 1967. The first 25 of those cars off the assembly line were sent to racers. This particular car was the 14th produced and was sent to Roger Penske.

This car is the first of only six Penske Camaros built between 1967 and 1969. The auction house says that over $330,000 was spent to restore the iconic car completely. The car comes with a file documenting its extensive racing history and photos of the car as it was discovered and during its restoration.

Continue Reading

Trending