Insights

Cisco released a patch for a critical security vulnerability affecting its Internet Key Exchange version 1 (IKEv1) and version 2 (IKEv2) of ASA software, the operating system that runs the company's Adaptive Security Appliance security devices. The flaw allows attackers to remotely execute code or reload affected systems and take over Adaptive Security Appliance (ASA) firewalls.

Integrity360 has today released the following advisory in relation to a recent upsurge in DDoS attacks. We’d like to encourage our clients to review this advisory and action as required. 

The recent issue that was disclosed publicly was resolved and a patch was made available in July 2014 as part of Fortinet's commitment to ensuring the quality and integrity of their codebase. This was not a “backdoor” vulnerability issue but rather a management authentication issue. The issue was identified by Fortinet's Product Security team as part of their regular review and testing efforts.

Administrative Access (CVE-2015-7755) only affects ScreenOS 6.3.0r17 through 6.3.0r20. VPN Decryption (CVE-2015-7756) only affects ScreenOS 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20.

THE BEST SECURITY

Many Irish organisations have become victim to a new wave of attacks resulting in financial loss for the victim companies. These attacks impersonate various stakeholders in the business, most frequently the CEO, senior management or a supplier. Emails are sent from this stakeholder requesting financial personnel make a payment or change payment details and redirect payments.