Cisco is advising administrators to update their systems following the discovery of a remote code execution vulnerability in its Security Agent 6.0 component.

The company said that the flaw could potentially allow an attacker to remotely target the Oracle Outside component for the Fusion Middleware platform to access the Cisco software on Windows systems. Successful exploitation of the flaw would allow the attacker to execute code on the targeted system.

Additionally, a successful exploit would allow the attacker to control the targeted system with administrator rights.

To address the vulnerability, Cisco has released a free patch. The company is advising users to obtain the Cisco Security Agent 6.0.2.151 fix through their service provider or hardware retailer. Cisco noted that no other mitigations for the vulnerability were known.

Cisco said that while proof of concept code for the vulnerability has been posted, the company has not received any reports of the flaw being exploited in the wild. No other products or components are believed to be effected by the vulnerability.

The release comes in the wake of patches from both Microsoft and Oracle. The Microsoft monthly patch included fixes for Silverlight and Internet Explorer, while the Oracle update contained a hefty 56 patches in all.

The update addressed issues in products ranging from Fusion Middleware to Linux. Additionally, the patch included fixes for a number of Sun software platforms.

Source:http://www.v3.co.uk/v3-uk/news/2120369/cisco-warns-remote-code-flaw-security-agent-software

Cisco will acquire BNI Video, a start-up developing video control plane software for cable operators, for approximately $99 million in cash and retention-based incentives.

BNI’s platform allows video service providers to easily incorporate social networking, search, and other next-generation applications into their offerings. BNI’s website says its control plane software connects content to subscribers, enabling transcoding and digital rights management, invoking quality of service to ensure the content produces the appropriate user experience, and interfacing with billing and entitlement systems to ensure that it is correctly monetized. The video control plane software and CDN manager are currently available.

Cisco said the acquisition will advance the capabilities of its own Videoscape TV platform, which allows service providers to deliver compelling video experiences to any device over any IP network.

BNI was founded in 2009 and is based in Boxborough, Mass.

Source:http://www.convergedigest.com/Startups/startuparticle.asp?ID=34392

Cisco this week released a massive set of security advisories detailing 10 separate vulnerabilities in some of its major software and unified communications products. It’s one of the broadest sets of security advisories Cisco has made all year.

The specific vulnerabilities, detailed on the Security Advisory section of Cisco’s corporate web site, includes a denial of service (DOS) vulnerability in Cisco’s IOS IP Service Level Agreement feature. That vulnerability is triggered when, according to Cisco, “malformed UDP packets are sent to a vulnerable device.” Cisco released software updates to address the vulnerability.

Another vulnerability is detailed for Cisco’s 10000 Series Router, in which an attacker can cause a device reload by sending a series of ICMP packets. Cisco released software updates, and in its security bulletin, also said workarounds are available to protect the routers.

Next up is a vulnerability in the Smart Install feature of Cisco Catalyst Switches running Cisco IOS Software. According to Cisco, which again released free software to combat the problem, an unauthenticated, remote attacker could be able to perform remote code execution on affected devices.

Another vulnerability is in Cisco’s Unified Communications Manager, which according to Cisco contains a “memory leak vulnerability that could be triggered through the processing of malformed Session Initiation Protocol (SIP) messages.” Free software is coming from Cisco for supported UCM versions, and there is an existing workaround, as well.

More vulnerabilities include the Data-Link Switching feature in Cisco’s IOS software, multiple DoS vulnerabilities in the network address translation (NAT) feature of IOS specific to NetMeeting Directory, SIP and H.323, and the IPv6 protocol stack implementation in IOS. Free software updates from Cisco address all, the company stated.

Additional DoS vulnerabilities exist in the SIP implementation in IOS and also Cisco’s IOS XE Software, Cisco said. Free software releases cover the vulnerabilities, and while there aren’t workaround available for devices that must run SIP, Cisco said mitigations can “limit exposure to the vulnerabilities.”

The last vulnerability mentioned by Cisco in this week’s update concerns the Jabber Extensible Communications Platform and Cisco Unified Presence. A DoS vulnerability exists in both through which an unauthenticated, remote attacker could send malicious XML to an affected server, Cisco said. There are no workarounds available, Cisco said.

Source:http://www.crn.com/news/security/231602414/cisco-security-warning-covers-ios-software-switches-routers-uc-tools-ipv6.htm;jsessionid=xMokXyjSTyvaE7HQ-L+xsw**.ecappj01

Cisco Systems has agreed to acquire service fulfillment software assets from the UK subsidiary of Comptel, in an effort to help operators speed up the launch of new services, the networking company said on Monday.

The deal is expected to close in September, and Cisco will pay about US$31 million in cash for the Axioss software, according to statements from the two companies.

Cisco will use the Axioss software to add automated ordering and fulfillment to its Prime platform, which allows operators to automate the management of network services. Operators will be able to quickly launch new video, data, mobility and cloud services to their customers, according to Cisco.

Upon the close of the acquisition, the Axioss team will be integrated into the Cisco’s NMTG (Network Management Technology Group) and its Advanced Services Group. Gareth Senior , Comptel CTO and member of the Executive Board, will move to Cisco. The services group “will offer implementation, customization and integration services”, and the new personnel will “bring strong software development and professional services skills,” Cisco said.

Comptel will keep its existing Axioss customers and continue to support them, it said.

Axioss was originally developed by Axiom Systems, a company that Comptel acquired 2008.

As operators search high and low for new revenue sources, the software side of their networks has received a lot more attention from vendors lately. For example, earlier this year, Ericsson announced it would acquire Telcordia. Its products will help monetize the traffic and products that operators sell, Ericsson said at the time.

On Monday, Alcatel-Lucent introduced a new set of services to analyze the health and performance of operator networks. Network performance is a critical issue, because it can be the difference between whether someone remains a loyal customer and continues to use an operators’ services, or defects to a rival, according to Alcatel-Lucent.

Source:http://www.pcworld.com/businesscenter/article/238569/cisco_announces_plan_to_buy_axioss_management_software.html

Comptel has sold to Cisco the fulfilment software it acquired when it bought Axiom Systems in 2008.

Cisco, a partner of Comptel, is buying the Axioss fulfilment software that forms part of Comptel’s Fulfilment Solution. Axioss assets are related to fulfilment software for operators’ IP services such as VPNs.

Olivier Suard, Marketing Director, said that the company would retain IP fulfilment capability after the sale. A release from the company said that it is building its next release of the Comptel Fulfillment Solution on a new technology platform that will be released in the first half of 2012. Comptel will also retain its existing Axioss customer relationships and will continue to support these customers.

“The message is that we are still very much in the fulfilment business, and it is [stated] in the deal that we can continue to support customers in that area,” he said.

Suard’s comments reflected that of Juhani Hintikka, CEO, who was quoted in Comptel’s press release as saying: “This does not change our fulfilment strategy, which is to achieve growth and the market-leader position for convergent telecom service providers.”

In 2008, Comptel paid €8.9 million for Axiom Systems Holdings Limited. Today it is selling the Axioss software business for €21.3 million.
Suard, who desribed the deal as “a good one”, said that the money would be invested in the continued development of products and services, including fulfilment.

“Our CEO is very much of the view that we need to invest to grow,” Suard said, “and this deal gives us both the incentive and the resource to invest even more.”

Gareth Senior, current Comptel CTO, will move to Cisco as part of the deal, as will some other staff. Suard said it has not been decided whether the office of CTO will be retained after Senior’s departure. Suard said that some of the functions of the office will move to Comptel’s Product and Solutions Unit.

Comptel said that the transaction is estimated to close in September 2011 and that Comptel and Cisco will continue their cooperation across other areas of OSS/BSS, including cloud mediation and charging.

The loss of Axioss would impact net sales by €2 million for the 2011, financial year, the company said. Comptel revised its full-year guidance, saying that in 2011 net sales are estimated to remain at the previous year’s level or to decrease slightly.

Source:http://www.mobileeurope.co.uk/news/news-analysis/8898-comptel-sells-axioss-fulfilment-software-to-cisco