Connect with us


Cisco’s warning: Patch now, critical SSH flaw affects Nexus 9000 fabric switches



Cisco: DNS attacks will undermine trust in the internet
Sophisticated hacking group taps wide set of vulnerabilities as part of their global hacking spree.

Cisco has revealed that its Nexus 9000 fabric switches have a critical flaw that could allow anyone to remotely connect to a vulnerable device using Secure Shell (SSH) and control it with root user privileges.

The company disclosed the bug on Tuesday and has given it a severity rating of 9.8 out of 10. 

The issue stems from SSH key management in the Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software. Cisco mistakenly put a default SSH key pair in the devices that an attacker could grab by connecting to the device over IPv6.

“An attacker could exploit this vulnerability by opening an SSH connection via IPv6 to a targeted device using the extracted key materials. An exploit could allow the attacker to access the system with the privileges of the root user,” Cisco explains, noting it can’t be exploited over IPv4.  

SEE: 10 tips for new cybersecurity pros (free PDF)

The bug was found by external security researcher Oliver Matula from ERNW Enno Rey Netzwerke. 

There are no workarounds, so Cisco is encouraging customers to update the software. 

The bug affects the 9000 Series Fabric Switches in ACI mode if it is running Cisco NX-OS Software release before 14.1(1i).  

Cisco has fixes available for several other vulnerabilities acting the Nexus 9000 software, all of which affect systems running Cisco NX-OS Software release prior to 14.1(1i)  

ERNW’s Matula also reported a medium-severity path traversal flaw in the Nexus 9000 ACI mode software that would allow a local attacker with valid credentials to use ‘symbolic links’ to overwrite potentially sensitive system files.   

Another fix in Cisco NX-OS Software 14.1(1i) is a high-severity elevation of privilege flaw that allowed a local attacker with valid admin credentials for a device to execute arbitrary NX-OS commands as the root user. 

“The vulnerability is due to overly permissive file permissions of specific system files. An attacker could exploit this vulnerability by authenticating to an affected device, creating a crafted command string, and writing this crafted string to a specific file location,” Cisco explains.  

Pre-14.1(1i) NX-OS also wasn’t properly validating TLS client certificates sent between components of an ACI fabric. 

An attacker with a certificate that is trusted by the Cisco Manufacturing certificate authority and the corresponding private key could present a valid certificate while attempting to connect to the targeted device.  

“An exploit could allow the attacker to gain full control of all other components within the ACI fabric of an affected device,” Cisco notes. 

More on Cisco and security

Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *


R-Reforged unveils Aston Martin Vantage V12 Zagato Heritage TWINS



Earlier this year, Swiss bespoke manufacturer R-Reforged has started production of its limited-edition Aston Martin V12 Vantage Zagato Heritage TWINS. This unique two-car collection starts at around $2-million and consists of a bespoke Vantage coupe and roadster to commemorate the 100th anniversary of Italian coachbuilder Zagato.

“The essence of this project was to create a perfect ‘garage,’ comprising two desirable and collectible cars, Coupe and Roadster,” said Andrea Zagato, CEO of Zagato. “Despite having created over 450 models since our formation, we chose Aston Martin, which has surely been our most prestigious partner over the last 50 years, to mark this celebration. The cooperation with R-Reforged ensured that we could create an instant classic.”

The first set of TWINS you see here will be on display at Aston Martin’s flagship St. Gallen dealership in Switzerland until early next year. It will also embark on a global tour across Europe and the United States before residing in Zagato’s private collection.

More importantly, the first TWINS will undergo benchmark testing at IDIADA in Spain beginning in early 2021. “We have brought together an incredible team of engineers and craftspeople to develop and produce their beautiful, exquisitely detailed cars that amplify the design, craftsmanship, performance, and ownership experience of the original,” said Thomas Mayer, CEO of R-Reforged.

Beauty is a given, but each twin has a bespoke, naturally-aspirated 5.7-liter V12 engine for maximum effect, producing close to 600 horsepower – 80 more horses than a previous-gen Vantage V12. Furthermore, each car is fitted with titanium exhausts and aluminum air intakes to deliver an aggressive roar that, according to Aston Martin and R-Reforged, is arguably one of the world’s greatest engine soundtracks.

A posh interior accompanies the delicate carbon-fiber coachwork and powerful engine. Only the finest Grade A Bridge of Weir leather is utilized for the seats and cabin, while every aspect of the TWINS is configurable and built to each owner’s exacting standards.

Additionally, each twin can be matched or can come in individual designs, and potential owners are encouraged to personalize every element of each vehicle. The Aston Martin V12 Zagato Heritage TWINS are sitting on a 20 mm stretched track, while the ride height is further lowered by 10 mm.

R-Reforged is only building 19 examples of both the Coupe and Roadster, a nod to the year when Ugo Zagato founded the company in Milan, Italy, back in 1919. Each pair of TWINS will be hand-assembled in R-Reforged’s 2,800 square-meter factory in Warwick, United Kingdom.

Continue Reading


Lamborghini commemorates the 30th birthday of Diablo supercar



The Lamborghini Diablo turns 30 this year, and the Italian carmaker is celebrating this momentous event by releasing gorgeous images of Lamborghini’s most-produced car of the past millennia. Following Lambo’s tradition of naming its vehicles after historic breeds of fighting bulls, Diablo drew its name after the Duke of Veragua’s fighting bull from the 19th century.

Born in 1985 under the codename Project 132, the Diablo has enormous shoes to fill. It succeeded the Countach as Lamborghini’s new V12 flagship model, and the project brief was to create a sports car with a top speed of at least 196 mph (315 kph).

The Diablo’s clean, aggressive lines are the brainchild of Marcello Gandini, the same person responsible for penning the Countach and Miura. In case you’re not aware, the Miura is widely regarded as the world’s first supercar.

You can essentially say Lamborghini started this whole supercar race with the Miura and Countach, but Diablo’s history is as exciting as the car itself. Chrysler bought Automobili Lamborghini in 1987, and the new top brass was not impressed with Gandini’s initial sketches.

As a result, Chrysler’s American design team went to work and softened the car’s sharp, angular lines. Befitting of a big Lambo, Diablo came with a classic Lamborghini V12 engine boasting 5.7-liters of displacement with four overhead camshafts, multi-point electronic injection, and four valves per cylinder, good for 485 horsepower and 428 pound-feet of torque.

The new Diablo went on sale in 1990, and it immediately became the fastest production car in the world. It can reach a top speed of 203.1 mph (325 kph), and it did it all with no traction control and power steering.

And yet, Diablo is more tossable than Countach around corners, thanks in large part to rally champion Sandro Munari’s development work in tuning the suspension and chassis. However, the luxurious cabin is worthy of praise. It came with standard leather upholstery, electric windows, electric seats, and air conditioning – not bad for a 90s-era supercar.

The original first edition Diablo came with a rear-wheel drivetrain. The Diablo VT (which stands for viscous traction) went on sale in 1993 and had a new all-wheel-drive system with a viscous center differential. The system can channel up to 25-percent of available torque to the front wheels to improve handling and grip.

After Audi bought Lamborghini from Chrysler in 1998, the Diablo SV came to market a year after, followed by the VT and VT Roadster. The final series came in 1998 as the Diablo GT, a track-focused version of the Diablo with a larger engine and bare interior.

Happy birthday, Lamborghini Diablo!

Lamborghini Diablo 30th Anniversary Gallery

Continue Reading


2021 Hennessey Venom 800 Ford F-150 hits 60 mph in 3.6 seconds



Many Ford fans are looking forward to the 2021 F-150 pickup. The truck is all-new, and the tuners at Hennessey have a special edition for truck buyers wanting sports car performance in their truck. The company says that the Hennessey Venom 800 Supercharged is the most powerful Ford truck it has ever produced.

The Venom 800 Supercharged is also one of the most exclusive Ford trucks the company has ever produced, with only 100 offered for the entire year. Thanks to a supercharger strapped on the 5.0-liter V-8 engine, the truck has 805 BHP and can reach 60 mph in 3.6 seconds. The turnkey vehicle starts with the 2021 Ford F-150 Platinum Super Crew four-door pickup.

The 5.0-liter V-8 is backed with a 10-speed automatic transmission, and the truck has four-wheel drive. Upgrades to the truck include an updated fuel pump system, stainless steel exhaust, E 85 flex-fuel sensor, and engine calibration performed on at chassis dyno. The supercharger and tuning double the stock V8 horsepower rating of 400 BHP.

When Hennessey is done, the F-150 has 805 BHP at 6200 RPM and 727 pound-foot of torque at 4100 RPM on E85. Hennessey brags that that is almost 100 horsepower more than the 2021 Ram TRX. The truck is capable of running the quarter-mile in 11.9 seconds at 116 mph.

It also gets an updated BREMBO brake system with six-piston calipers and 15.1-inch rotors to slow the monster down. Wheels are 20-inch custom units with 35-inch all-terrain tires. The truck also gets an off-road suspension system with upgraded shocks and external reservoirs supporting a six-inch lift. The front bumper is upgraded along with the grill, and the truck gets new badges. Pricing for the vehicle is $149,500 plus delivery, including the donor pickup.

Continue Reading