Leak In Cisco IP Phones Allows Eavesdropping Possible

Networking giant Cisco warns of vulnerability in the SPA300 and SPA500 IP phones allowing attackers without credentials distance calls can eavesdrop or to gain access to the phone to call then himself. However, an update is not yet available.

Also could be used for a successful attack further attacks, said the advisory . The vulnerability is caused by authentication settings in the default configuration. An attacker would through a specially prepared XML request to send here to abuse a vulnerable device.

Cisco says that in order to exploit this vulnerability, an attacker allowing access to a trusted internal network behind a firewall should be to send the XML request. This requirement would reduce the possibility of a successful attack. Since there is no update available system get the advice to turn XML Execution authentication in the configuration settings.Furthermore, could protect a "solid firewall strategy" systems and can be considered to give only trusted IP addresses access.

Companies Change Delivery Address Cisco Equipment Due To NSA

Some companies use other delivery addresses when ordering equipment from Cisco in order to evade the NSA, so, Cisco CEO John Stewart at a conference to know. Following his revelations of whistleblower Edward Snowden, showing that the NSA intercepted orders such as routers and then provides a backdoor. On one of the photos that were shown publicly through Snowden how NSA staff a box of Cisco equipment opens.

Stewart, chief security and trust officer at the networking giant says that it prevents companies specify delivery addresses that have nothing to do with the client, reports PC World . This should make it theoretically difficult for the NSA to focus on a particular company. Stewart did know, however, that once Cisco provides the equipment to a shipping company, it has no control anymore. However, Cisco could collaborate with customers to better control the integrity of delivered systems.

Yet then Stewart will always be risks that can not be avoided. "As a truly motivated team it has provided you, and they do this for a long period of time, this increases the chance that they will succeed again." Stewart was at the conference whether Cisco has ever encountered strange hardware in its own products which was placed there. "No, and that we could not know, because the only people who know for sure that the NSA," the CEO said.