So Cisco will give you firmware updates to your device as long as you can prove the update patches a current security vulnerability. Not sure I’d ever be saying this , but thanks to Heartbleed exploit , all Cisco devices will be effected by this
This blog explains how to get the version of your current switch/router and query Cisco’s database for exploits, however I needed to find a vulnerability of my Cisco Fabric Switch …
https://damn.technology/free-cisco-ios-updates
All you need to do is Google your switch OS with vulnerability afterwards to get them!
See the email thread that worked , you need to email [email protected]
Thank you for providing the SA/PSIRT ID. Kindly give me your CCO ID for us to publish the file as an exception.
Regards,
Cisco.com Support
———————————————————————————————————————————
Sure It’s the Heart Bleed problem found last year
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150612-openssl
And also this one
https://tools.cisco.com/bugsearch/bug/CSCuy37040
Thanks
Paris
——————————————————————————————————————————
Kindly provide us the PSIRT or Security Advisory ID you are encountering.
Regards,
Cisco.com Support
——————————————————————————————————————————
Thanks , however :
As it stands, CISCO’s security vulnerability policy states that (emphasis mine):
As a special customer service, and to improve the overall security of the Internet, Cisco may offer customers free of charge software updates to address security problems. If Cisco has offered a free software update to address a specific issue, noncontract customers who are eligible for the update may obtain it by contacting the Cisco TAC using any of the means described in the Contact Summary section of this document. To verify their entitlement, individuals who contact the TAC should have available the URL of the Cisco document that is offering the update.
See below for the following Security Fixed this patch provides us
Security Advisories, Responses and Notices
- Cisco Device Manager Command Execution Vulnerability<http://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20130424-fmdm.html>
- Cisco MDS 9000 NX-OS Software Denial of Service Vulnerability<http://www.cisco.com/c/en/us/support/docs/csa/Cisco-SA-20131106-CVE-2013-5566.html>
- Cisco MDS 9000 Series Denial of Service Vulnerability<http://www.cisco.com/c/en/us/support/docs/csa/Cisco-SA-20150114-CVE-2015-0582.html>
- Cisco NX-OS FCIP Remote Denial of Service Vulnerability<http://www.cisco.com/c/en/us/support/docs/csa/Cisco-SA-20120810-CVE-2012-1340.html>
- Cisco NX-OS Software Input Validation Vulnerability<http://www.cisco.com/c/en/us/support/docs/csa/Cisco-SA-20131008-CVE-2012-4121.html>
- Cisco Nexus Devices Python Subsystem Local Privilege Escalation Vulnerabilities<http://www.cisco.com/c/en/us/support/docs/csa/Cisco-SA-20150630-CVE-2015-4234.html>
- Cisco Nexus Operating System Devices Command Line Interface Local Privilege Escalation Vulnerability<http://www.cisco.com/c/en/us/support/docs/csa/Cisco-SA-20150701-CVE-2015-4237.html>
- Cisco Nexus and Cisco Multilayer Director Switches MOTD Telnet Login Reset Vulnerability<http://www.cisco.com/c/en/us/support/docs/csa/Cisco-SA-20150610-CVE-2015-0775.html>
- Cisco Software Encryption Library Information Disclosure Vulnerability<http://www.cisco.com/c/en/us/support/docs/csa/Cisco-SA-20120913-CVE-2011-4667.html>
- Multiple Vulnerabilities in Cisco NX-OS-Based Products<http://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20130424-nxosmulti.html>
- Multiple Vulnerabilities in ntpd (April 2015) Affecting Cisco Products<http://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20150408-ntpd.html>
- Multiple Vulnerabilities in ntpd Affecting Cisco Products<http://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20141222-ntpd.html>
Thanks
Paris
——————————————————————————————————————
Subject: Re: Security Update
Thank you for contacting Software Download Centre.
In order to download software from Cisco’s software download center, your product must be covered under an active service contract that provides access to download Software. Hardware and Software warranty do not provide access to software download.
I reviewed the information you provided and have determined that the product you are trying to download software for SN: FOX1526GB6B is not covered under a service contract.
Please contact your Cisco Services Representative (partner, reseller, or Cisco Service Account Manager) to purchase a service contract that provides access to software downloads and upgrades for this device.
Regards,
Cisco.com Support
—————————————————————————————————————–
Subject: Security Update
Please can I get the latest file for me device ( m9100-s2ek9-kickstart-mz.5.2.8g.bin )
Model number is DS-C9124-K9
Serial number is XXXXXXXXX
Currently we don’t have a support contract however looking for the latest security updates
Thanks
Paris
Loading...