Hello, welcome to the Friday, November 9th, 2018 edition of the Sands and at Storm Center's Stormcast.

My name is Johannes Ulrich, and the I'm recording from Jacksonville, Florida.

Cisco released a number of security bulletins these last two days, and among all the bulletins released there are sort of

five that stick out four of which are rated critical and one informational well let's start

with the informational one the informational one is in so far interesting in that it's pretty

embarrassing but not really all that severe. It affects the Cisco

Telepresence video communication server and apparently what happened here is that some test script

from testing debugging the software were left behind on the shipped version of the product.

Now this wouldn't be quite as bad, but part of

these test scripts are actually exploits. For example, a Cisco internally developed exploit

for the Dirty Cow vulnerability. Dirty Cow was a privilegelish escalation vulnerability affected Linux.

Now Cisco essentially states that that makes actually some sense that they're using these exploits to make sure that released software and hardware isn't vulnerable to any of these exploits.

But then again, not removing these test scripts does show some lack of control in actually

releasing the software.

Now, by just sitting there on the system, these exploits don't really do much damage.

An attack graph would still have to gain access to the system to take advantage of these

exploits.

And at that point, they may be able to just upload the exploits to the system to take advantage of these exploits and at that point they may be able to

just upload the exploits to the system. Now among the critical bulletins we have one that covers

a number of different Cisco products that all use Struts 2.5. Remember we just had this file

upload vulnerability in Struts 2.5 and Remember, we just had this file upload vulnerability in struts 2.5. And of course, any product

using struts 2.5 is affected here. And you'll probably see similar announcements from other

...