In-brief: Both Cisco Systems and Fortinet confirmed that vulnerabilities targeted by tools leaked by the previously unknown group Shadow Brokers were real.
The story about the so-called “Shadow Brokers” hack, allegedly of the National Security Agency (NSA), took another turn on Wednesday with both Cisco Systems and Fortinet confirming that vulnerabilities targeted by tools released by the previously unknown group were real.
As reported by TechCrunch, Cisco said in a security advisory that two vulnerabilities in the Shadow Brokers’ data could be used to breach its Adaptive Security Appliance (ASA) software used in its firewalls.
“An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system,” Cisco said in a security advisory released Wednesday.
In a separate statement on Wednesday, network security equipment vendor Fortinet, acknowledged that FortiGate firmware (FOS) released before Aug 2012 contained a buffer overflow vulnerability that could be exploited by a specially crafted HTTP request, giving a remote attacker control over the Fortinet devices. The company is continuing to investigate the Shadow Brokers release to see if newer versions of the FortiGate firmware.
Source: Cisco and Fortinet say vulnerabilities disclosed in ‘NSA hack’ are legit | TechCrunch