Cisco Patches Serious Flaws In Cable Modems and Home Gateways (csoonline.com) 22
itwbennett writes: Cisco Systems has patched high-impact vulnerabilities in several of its cable modem and residential gateway devices that are distributed by some ISPs to their customers, and said in an advisory that customers should contact their service providers to ensure they have the patches. The embedded Web server in the Cisco Cable Modem with Digital Voice models DPC2203 and EPC2203 contains a buffer overflow vulnerability that can be exploited remotely without authentication. And the Web-based administration interfaces of the Cisco DPC3941 Wireless Residential Gateway with Digital Voice and Cisco DPC3939B Wireless Residential Voice Gateway are affected by a vulnerability that could lead to information disclosure. In addition, the Cisco Model DPQ3925 8x4 DOCSIS 3.0 Wireless Residential Gateway with EDVA is affected by a separate vulnerability, also triggered by malicious HTTP requests, that could lead to a denial-of-service condition.
Re: (Score:1)
That's funny... (Score:2)
Re: (Score:2)
Re: (Score:3)
Probably because the vast majority of ISP's don't use publicly addressable IP's for the cable modem interface, ever. And if they do, they're idiots.
That still leaves room for CSRF attacks
Are those flawed modems... (Score:2)
...some of the ones that the corrupt ISPs "rent" to users for like $10/month? What a bargain!
Re: (Score:1)
No longer needed? (Score:2)
Re: (Score:3)
Funny, but these are probably be fixed because Cisco is absolutely being destroyed in the enterprise security publications for all the unfixed vulnerabilities including things that are 10 years old like SSL 2.0 still being enabled. They were absolutely destroyed in the press for unfixed vulnerabilities a couple weeks ago by IIRC CERT, I have a feeling it's starting to effect their sales and they are responding so they don't loose all sales.
U FAIL IT (Score:2)
If you're using an ISP-provided modem, congratulations, U FAIL IT.
1: Buy a Surfboard.
2: Toss the ISP shit into the toilet, then call the ISP and tell them to come pick it up.
Re: (Score:3)
Obama Let Me Be Clear.wav
By "Surfboard" I mean the Motorola/Arris modem line. If you want to buy an actual surfboard, go for it.
Re: (Score:2)
Where can we buy our own cable modems with EMATA for the landline phone services? And without using splitters (signals are bad enough here) to hog another power plug, making more heat and space, etc.
Re: (Score:2)
I believe I've seen them on Amazon.
Various versions of the Surfboards will support the VoIP-specific shit. I've read reviews saying shit like "model xyz is the same as xyw but xyw supports Comcast's VoIP". Can't tell you if it's true or not, as I don't use a landline (pots or voip or otherwise) and I don't have Comcast (I know they can be picky with modems though).
Audit in progress? (Score:2)