----------------------------------------------------------------------

Hardcore Disassembler / Reverse Engineer Wanted!

Want to work with IDA and BinDiff?
Want to write PoC's and Exploits?

Your nationality is not important.
We will get you a work permit, find an apartment, and offer a
relocation compensation package.

http://secunia.com/hardcore_disassembler_and_reverse_engineer/

----------------------------------------------------------------------

TITLE:
Cisco Router Web Setup Insecure Default Cisco IOS Configuration

SECUNIA ADVISORY ID:
SA21028

VERIFY ADVISORY:
http://secunia.com/advisories/21028/

CRITICAL:
Moderately critical

IMPACT:
System access

WHERE:
>From local network

SOFTWARE:
Cisco Router Web Setup 3.x
http://secunia.com/product/11021/

DESCRIPTION:
A security issue has been reported in Cisco Router Web Setup, which
potentially can be exploited by malicious people to compromise a
vulnerable system.

The problem is caused due to the application shipping with an
insecure default Cisco IOS configuration. This can be exploited to
execute arbitrary commands with privilege level 15 via the web
interface.

The security issue has been reported in versions prior to 3.3.0 build
31.

SOLUTION:
Update to version 3.3.0 build 31.
http://www.cisco.com/pcgi-bin/tablebuild.pl/crws

NOTE: Users upgrading from a previous version, who wish to keep their
existing configuration, should apply the workarounds described in the
vendor advisory.

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
Cisco:
http://www.cisco.com/warp/public/707/cisco-sa-20060712-crws.shtml

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------