Cisco warns of new security risks

Networking vendor Cisco is warning its enterprise users of several recently discovered and patched security flaws.

The first exists in the company's Access Control Server (ACS) offering. If exploited, the vulnerability could allow an attacker to crash the server, leading to a denial of service.

The flaw is believed to exist in all current versions of ACS for Windows and Cisco Secure ACS Solution Engine. The company has issued a patch and is advising network administrators to apply the update.

The vulnerability exists in the handling of remote access dial-in user service (RADIUS) communications. An attacker could exploit the vulnerability by way of a specially-crafted RADIUS authentication data packet sent to the server.

The company noted that, in order for the exploit to be carried out, the attacker must know the IP address of the target server as well as the Radius Shared Secret.

Discovery of the issue was credited to researchers Laurent Butti and Gabriel Campana.

Cisco also warned of six flaws in its ASA 5500 adaptive security and pix security appliances.

The vulnerabilities include five denial of service flaws and one which could lead to information disclosure.

The company is advising its users to apply the latest updates for both appliances in order to protect against attack.