Aussie security firm find holes in Cisco wireless

The vulnerabilities were discovered after studying the Cisco Wireless LAN Solution Engine. The security team found vulnerabilities within the Cisco Hosting Solution Engine (HSE), the Ethernet Subscriber Solution Engine (ESSE), CiscoWorks2000 Service Management Solution (SMS), the Cisco VLAN Policy Server (VPS) and the ME1100 Series of the Cisco Management Engine.

Cisco announced fixes for the vulnerabilities on Thursday April 20. Assurance.com.au has been assisting Cisco since January 31 to resolve the issue. Assurance.com.au director Adam Pointon discovered the vulnerability while on a customer site and said a breach will ultimately allow unauthorized software to be installed by a "rogue administrator," which will be virtually undetectable.

"The vulnerability is extremely easy to exploit and it's possible for a rogue administrator to access the underlying operating system by typing one specially crafted command into Cisco's restricted, text-based management interface," Pointon said.

"These embedded appliances are actually Linux-based systems. By exploiting the vulnerability, it's possible for a rogue administrator to install unauthorized software on these devices that would be virtually undetectable to future administrators, and that's a problem."

Neal Wise, a director of Assurance.com.au, said if the devices in question are not correctly maintained they could become a serious liability to the enterprise; however, he said Cisco was very responsive in releasing patches, despite the perceived three-month turnaround.