Cisco Issues Data Center Network Manager Update to Fix Three Vulnerabilities

Anybody using Cisco Systems' Data Center Network Manager needs to apply software updates Cisco released Thursday to address serious multiple authentication vulnerabilities. The company said there were no workarounds, which means operators can't safely put updating on hold until their next scheduled patch day or until they're certain the new software won't create new problems.

The vulnerabilities affect all versions of DCNM earlier than 11.3(1) for Windows, Linux, and virtual appliance platforms.

DCNM is the management system for Cisco's Unified Fabric. It provides a dashboard for data center operators to provision, monitor, and troubleshoot network infrastructure.

The updated software aims primarily at fixing three vulnerabilities that carry a 9.8 rating on the 10-point Common Vulnerability Scoring System scale. These security holes could be used by remote attackers to bypass authentication and gain administrative privileges on affected systems.

The vulnerabilities are not dependent on one another, Cisco said, meaning an attacker doesn't have to take advantage of one vulnerability before being able to exploit another. In addition, one DCNM software release affected by one of the vulnerabilities is not necessarily affected by others.

Drilling Into the Vulnerabilities

Although the three vulnerabilities are are not connected to one another, they can all be used by unauthenticated remote attackers to bypass authentication. Two of the three are due to a static encryption key that is shared between installations:

The good news for administrators is that, according to Cisco, the vendor has seen no evidence that these vulnerabilities are being actively exploited.

The software fixes also include remedies for seven additional DCNM vulnerabilities involving REST and SOAP APIs, which, Cisco said, are less severe. Access to the updated software and information on its installation is available on Cisco's website.