Cisco issues free software updates to fix weaknesses in its Enterprise NFV Infrastructure Software. Multiple vulnerabilities have been discovered in Cisco’s Enterprise NFV Infrastructure Software (NFVIS). The worst of the vulnerabilities could let an attacker escape from the guest virtual machine (VM) to the host machine, Cisco disclosed. The other two problems involve letting a bad actor inject commands that execute at the root level and allowing a remote attacker to leak system data from the host to the VM. NFVIS is Linux-based infrastructure software designed to help enterprises and service providers to deploy virtualized network functions, such as a virtual router, firewall and WAN acceleration, Cisco stated. The critical vulnerability – with a CVSS score of 9.9 out of 10 – could allow an attacker to send an API call from a VM that will execute with root-level privileges on the NFVIS host. A successful exploit could allow the attacker to completely compromise an NFVIS host. Cisco said the vulnerability is due to insufficient guest restrictions. Another exposure in the image registration process of NFVIS could let an unauthenticated, remote attacker inject commands that could then execute at the root level on the NFVIS host during the image registration process. The weakness could convince an administrator on the host machine to install a VM image with crafted metadata that will execute commands with root–level privileges during the VM registration process, Cisco stated. A successful exploit could allow the attacker to inject commands with root-level privileges into the NFVIS host. This vulnerability is due to improper input validation, Cisco stated. The third NFVIS advisory relates to the import function of the software that could let an unauthenticated, remote attacker leak system data from the host to any configured VM. An attacker could exploit this vulnerability by persuading an administrator to import a crafted file that will read data from the host and write it to any configured VM. A successful exploit could allow the attacker to access system information from the host, such as files containing user data, on any configured VM, Cisco stated. An attacker who already has authenticated access on a VM that is configured within the NFVIS host could obtain direct access to confidential system information, Cisco stated. This vulnerability is due to the resolution of external entities in the XML parser, Cisco added. Cisco has issued free software updates that address these vulnerabilities and said there are no workarounds. Related content how-to The logic of && and || on Linux These AND and OR equivalents can be used in scripts to determine next actions. By Sandra Henry-Stocker May 02, 2024 4 mins Linux analysis Cisco-backed startup Corelight raises $150M to expand network security services Corelight aims to boost AI-driven security operations, cloud visibility and detection, and next-generation SIEM platforms. By Michael Cooney May 02, 2024 4 mins Network Security Networking news F5 looks to squelch 'ball of fire' that is application security Updates include security scanning and penetration testing capabilities for web applications, as well as a new container-based web application firewall. By Michael Cooney May 01, 2024 4 mins Firewalls Network Security Networking news Arista targets lateral security threat in campus and data center networks Arista Macro-Segmentation Service sets up microperimeters for enterprise resource protection. By Michael Cooney May 01, 2024 3 mins Remote Access Security Network Security Networking PODCASTS VIDEOS RESOURCES EVENTS NEWSLETTERS Newsletter Promo Module Test Description for newsletter promo module. Please enter a valid email address Subscribe