Cisco ACE应用控制引擎模块和Cisco ACE 4710应用控制引擎未明SNMPv3报文拒绝服务攻击漏洞

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接：

Cisco已经为此发布了一个安全公告(cisco-sa-20090225-ace)以及相应补丁:

cisco-sa-20090225-ace：Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine

http://www.cisco.com/warp/public/707/cisco-sa-20090225-ace.shtml"

补丁下载：

http://tools.cisco.com/support/downloads/go/Redirect.x?mdfid=280557289

http://tools.cisco.com/support/downloads/go/Redirect.x?mdfid=281222179

临时解决方法：

默认用户名和口令

如果要更改默认的管理口令，以配置模式使用username命令，该命令句法如下：

#username admin [password [0 | 5] {password}]

特制SSH报文漏洞

可通过使用类映射、策略映射和服务策略控制ACE所接收到的SSH管理通讯。

以下示例显示如何仅允许来自192.168.100.1的主机SSH访问ACE：

Configure a class to allow SSH from the trusted source

#class-map type management match-all Permit_SSH_Class

# description Allow SSH from trusted sources Class

# match protocol ssh source-address 192.168.100.1 255.255.255.255

Configure a management policy that allows ssh from the

#trusted source configured in the above class

#policy-map type management first-match Permit_SSH_Policy

#description Allow SSH from trusted sources Policy

# class Permit_SSH_Class

permit Apply the management policy globally

#service-policy input Permit_SSH_Policy

特制SNMPv2和SNMPv3报文漏洞

可通过使用类映射、策略映射和服务策略控制ACE所接收到的SNMP管理通讯。

Configure a class to allow SNMP from the trusted source

#class-map type management match-all Permit_SNMP_Class

#description Allow SNMP from trusted sources Class

# match protocol snmp source-address 192.168.100.1 255.255.255.255

Configure a management policy that allows snmp from the

#-trusted source configured in the above class

#policy-map type management first-match Permit_SNMP_Policy

#description Allow SNMP from trusted sources Policy

#class Permit_SNMP_Class

Permit Apply the management policy globally

#service-policy input Permit_SNMP_Policy

来源: SECTRACK

名称: 1021769

链接:http://www.securitytracker.com/id?1021769

来源: BID

名称: 33900

链接:http://www.securityfocus.com/bid/33900

来源: CISCO

名称: 20090225 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine

链接:http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml