Re: [Full-disclosure] Drive-by Pharming

From: "Brian Eaton" <eaton.lists@xxxxxxxxx>
Date: Fri, 16 Feb 2007 10:49:47 -0500

On Thur, 16 Feb 2007 02:00:00 +0800, psirt@xxxxxxxxx <psirt@xxxxxxxxx> wrote:

As the paper does not disclose any new vulnerability in Cisco products,
Cisco is issuing this response and not a Security Advisory. The purpose
of this response is to inform customers how to change any default
credentials which may ship pre-configured on an impacted Cisco router
(identified below), upon initial configuration and before the device is
connected to a public network.

The Drive-by Pharming paper also relied on exploiting CSRF
vulnerabilities in the router web administration interfaces. Changing
the passwords does a lot to mitigate the risk, but the CSRF
vulnerabilities should be fixed.

Regards,
Brian

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

References:
- Re: [Full-disclosure] Drive-by Pharming
  - From: psirt

Prev by Date: Re: [Full-disclosure] phishing sites examples "source code"
Next by Date: Re: [Full-disclosure] phishing sites examples "source code"
Previous by thread: Re: [Full-disclosure] Drive-by Pharming
Next by thread: Re: [Full-disclosure] Drive-by Pharming
Index(es):
- Date
- Thread

Relevant Pages

[Full-disclosure] Cisco Security Advisory: Voice Vulnerabilities in Cisco IOS and Cisco Unified
... Voice Vulnerabilities in Cisco IOS and Cisco Unified Communications Manager ... Any Cisco device that runs a vulnerable version of IOS and supports SIP ...
(Full-Disclosure)
Re: Cisco PIX security advisory - upgrade to 6.3.5 ASAP
... Multiple Vulnerabilities Found by PROTOS IPSec Test Suite ... Multiple Cisco products contain vulnerabilities in the processing of IPSec ... Prior to deploying software, customers should consult ...
(comp.dcom.sys.cisco)
Cisco Security Advisory: Cisco Secure Access Control Server for Windows User-Changeable Password
... Cisco Security Advisory: Cisco Secure Access Control Server for ... Two sets of vulnerabilities were discovered in the Cisco Secure ... conditions in the UCP application that could result in remote ...
(Bugtraq)
[Full-disclosure] Cisco Security Advisory: Cisco Secure Access Control Server for Windows User&#
... Cisco Security Advisory: Cisco Secure Access Control Server for ... Two sets of vulnerabilities were discovered in the Cisco Secure ... conditions in the UCP application that could result in remote ...
(Full-Disclosure)
[Full-disclosure] Cisco Security Advisory: Multiple Vulnerabilities in Cisco Secure Desktop
... Cisco Security Advisory: Multiple Vulnerabilities in Cisco Secure Desktop ... The Cisco Secure Desktop (CSD) seeks to minimize data from being left ...
(Full-Disclosure)