Security & Hacking (Facepalm edition): "Cisco switches to weaker hashing scheme, passwords cracked wide open"

http://arstechnica.com/security/2013/03/cisco-switches-to-weaker-hashing-scheme-passwords-cracked-wide-open/

TL:DR version:

"It turns out that Cisco's new method for converting passwords into one-way hashes uses a single iteration of the SHA256 function with no cryptographic salt. The revelation came as a shock to many security experts because the technique requires little time and computing resources."

Security & Hacking: "Multiple Vulnerabilities in Cisco Wireless LAN Controllers"

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130123-wlc

Cut & Paste from above link:

"Summary

The Cisco Wireless LAN Controller (Cisco WLC) product family is affected by the following four vulnerabilities:

• Cisco Wireless LAN Controllers Wireless Intrusion Prevention System (wIPS) Denial of Service Vulnerability
  
• Cisco Wireless LAN Controllers Session Initiation Protocol Denial of Service Vulnerability
  
• Cisco Wireless LAN Controllers HTTP Profiling Remote Code Execution Vulnerability
  
• Cisco Wireless LAN Controllers SNMP Unauthorized Access Vulnerability
  

 

Vulnerable Products

For specific version information, refer to the Software Versions and Fixes section of this advisory.
Each of the following products is affected by at least one of the vulnerabilities covered in this security advisory:

• Cisco 2000 Series WLC
• Cisco 2100 Series WLC
• Cisco 2500 Series WLC
• Cisco 4100 Series WLC
• Cisco 4400 Series WLC
• Cisco 5500 Series WLC
• Cisco 7500 Series WLC
• Cisco 8500 Series WLC
• Cisco 500 Series Wireless Express Mobility Controllers
• Cisco Wireless Services Module (Cisco WiSM)
• Cisco Wireless Services Module version 2 (Cisco WiSM version 2)
• Cisco NME-AIR-WLC Module for Integrated Services Routers (ISRs)
• Cisco NM-AIR-WLC Module for Integrated Services Routers (ISRs)
• Cisco Catalyst 3750G Integrated WLCs
• Cisco Flex 7500 Series Cloud Controller
• Cisco Virtual Wireless Controller
• Cisco Wireless Controller Software for Integrated Services Module 300 and Cisco Services-Ready Engine 700, 710, 900, and 910"

Security & Hacking: "Cisco Linksys Remote Preauth 0day Root Exploit "

From DefenseCode http://blog.defensecode.com/2013/01/defensecode-security-advisory-upcoming.html

"Exploit shown in this video has been tested on Cisco Linksys WRT54GL, but other 

Linksys versions/models are probably also affected.

Cisco Linksys is a very popular router with more than 70,000,000 routers sold.

That's why we think that this vulnerability deserves attention.

According to our vulnerability disclosure policy, the vulnerability details will be

disclosed in following 2 weeks on http://www.defensecode.com/, BugTraq and

Full Disclosure."

Related:

• BugTraq http://www.securityfocus.com/
  
• Full Disclosure http://seclists.org/fulldisclosure/