Vulnerabilities in Cisco Video Surveillance IP Gateway and the Content Switch Module for Catalyst 6500
Cisco has issued two security alerts on their video surveillance systems and modules load balancers. These flaws could allow an attacker to obtain access to the gateway IP Video Surveillance with administrator privileges or cause a denial of service in the Load Balancer Content Switching Module (CSM) for Catalyst 6500 switches.
The problem is based on the Telnet server Video Surveillance IP Gateway, which does not require any authentication to allow access. In addition, the Platform Services and Integrated Services Platform
(SP / ISP) are supplied with standard passwords for users known as sypixx and root. This would allow an attacker to access with administrative privileges. Affected the previous version 1.1 and 1.8 Video Surveillance Decoder SP / ISP, and all Video Surveillance SP / ISP to 1.23.7.
The Content Switch module for the Catalyst 6500 does not handle properly handled especially network packets (out of order, according to Cisco).
This can cause the device to put your CPU at 100% and started again, what would be considered a denial of service. MSC-S with SSL is also suffering an unspecified security issue. Affected up to version 4.2.3a (not included) to the CSM and 2.1.2a of CSM-S.
in:
http://www.cisco.com/warp/public/707/cisco-sa-20070905-video.shtml
Source: www.hispasec.com
