Cisco

german-router-maker-is-latest-company-to-inadvertently-clarify-the-lgpl-license

German router maker is latest company to inadvertently clarify the LGPL license

avm, Cisco, free and open source, Free Software Foundation, FSF, GPL, LGPL, Linksys, Open Source, open source licenses, SFLC, Tech / /

The GNU General Public License (GPL) and its “Lesser” version (LGPL) are widely known and used. Still, every so often, a networking hardware maker has to get sued to make sure everyone knows how it works.

The latest such router company to face legal repercussions is AVM, the Berlin-based maker of the most popular home networking products in Germany. Sebastian Steck, a German software developer, bought an AVM Fritz!Box 4020 (PDF) and, being a certain type, requested the source code that had been used to generate certain versions of the firmware on it.

According to Steck’s complaint (translated to English and provided in PDF by the Software Freedom Conservancy, or SFC), he needed this code to recompile a networking library and add some logging to “determine which programs on the Fritz!Box establish connections to servers on the Internet and which data they send.” But Steck was also concerned about AVM’s adherence to GPL 2.0 and LGPL 2.1 licenses, under which its FRITZ!OS and various libraries were licensed. The SFC states that it provided a grant to Steck to pursue the matter.

AVM provided source code, but it was incomplete, as “the scripts for compilation and installation were missing,” according to Steck’s complaint. This included makefiles and details on environment variables, like “KERNEL_LAYOUT,” necessary for compilation. Steck notified AVM, AVM did not respond, and Steck sought legal assistance, ultimately including the SFC.

Months later, according to the SFC, AVM provided all the relevant source code and scripts, but the suit continued. AVM ultimately paid Steck’s attorney fee. The case proved, once again, that not only are source code requirements real, but the LGPL also demands freedom, despite its “Lesser” name, and that source code needs to be useful in making real changes to firmware—in German courts, at least.

“The favorable result of this lawsuit exemplifies the power of copyleft—granting users the freedom to modify, repair, and secure the software on their own devices,” the SFC said in a press release. “Companies like AVM receive these immense benefits themselves. This lawsuit reminded AVM that downstream users must receive those very same rights under copyleft.”

As noted by the SFC, the case was brought in July 2023, but as is typical with German law, no updates on the case could be provided until after its conclusion. SFC posted its complaint, documents, and the source code ultimately provided by AVM and encouraged the company to publish its own documents since those are not automatically public in Germany.

German router maker is latest company to inadvertently clarify the LGPL license Read More »

vulnerability-in-cisco-smart-software-manager-lets-attackers-change-any-user-password

Vulnerability in Cisco Smart Software Manager lets attackers change any user password

Biz & IT, Cisco, passwords, Security, vulnerabilities / /

GET YER PATCH —

Yep, passwords for administrators can be changed, too.

–

Vulnerability in Cisco Smart Software Manager lets attackers change any user password

Cisco on Wednesday disclosed a maximum-security vulnerability that allows remote threat actors with no authentication to change the password of any user, including those of administrators with accounts, on Cisco Smart Software Manager On-Prem devices.

The Cisco Smart Software Manager On-Prem resides inside the customer premises and provides a dashboard for managing licenses for all Cisco gear in use. It’s used by customers who can’t or don’t want to manage licenses in the cloud, as is more common.

In a bulletin, Cisco warns that the product contains a vulnerability that allows hackers to change any account’s password. The severity of the vulnerability, tracked as CVE-2024-20419, is rated 10, the maximum score.

“This vulnerability is due to improper implementation of the password-change process,” the Cisco bulletin stated. “An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user.”

There are no workarounds available to mitigate the threat.

It’s unclear precisely what an attacker can do after gaining administrative control over the device. One possibility is that the web user interface and application programming interface the attacker gains administrative control over make it possible to pivot to other Cisco devices connected to the same network and, from there, steal data, encrypt files, or perform similar actions. Cisco representatives didn’t immediately respond to an email. This post will be updated if a response comes later.

A security update linked to the bulletin fixes the vulnerability. Cisco said it isn’t aware of any evidence that the vulnerability is being actively exploited.

Vulnerability in Cisco Smart Software Manager lets attackers change any user password Read More »

counterfeit-cisco-gear-ended-up-in-us-military-bases,-used-in-combat-operations

Counterfeit Cisco gear ended up in US military bases, used in combat operations

Biz & IT, china, Cisco, Hong Kong, Networking / /

Cisno —

“One of the largest counterfeit-trafficking operations ever.”

–

Cisco Systems headquarters in San Jose, California, US, on Monday, Aug. 14, 2023.

Enlarge / Cisco Systems headquarters in San Jose, California.

A Florida resident was sentenced to 78 months for running a counterfeit scam that generated $100 million in revenue from fake networking gear and put the US military’s security at risk, the US Department of Justice (DOJ) announced Thursday.

Onur Aksoy, aka Ron Aksoy and Dave Durden, pleaded guilty on June 5, 2023, to two counts of an indictment charging him with conspiring with others to traffic in counterfeit goods, to commit mail fraud, and to commit wire fraud. His sentence, handed down on May 1, also includes an order to pay $100 million in restitution to Cisco, a $40,000 fine, and three years of supervised release. Aksoy will also have to pay his victims a sum that a court will determine at an unspecified future date, the DOJ said.

According to the indictment [PDF], Aksoy began plotting the scam around August 2013, and the operation ran until at least April 2022. Aksoy used at least 19 companies and about 15 Amazon storefronts, 10 eBay ones, and direct sales—known collectively as Pro Network Entities—to sell tens of thousands of computer networking devices. He imported the products from China and Hong Kong and used fake Cisco packaging, labels, and documents to sell them as new and real. Legitimate versions of the products would’ve sold for over $1 billion, per the indictment.

The DOJ’s announcement this week said the devices had an estimated retail value of “hundreds of millions of dollars” and that Aksoy personally received millions of dollars.

Fake Cisco tech used in Air Force, Army, and Navy applications

The US military used gear purchased from Aksoy’s scheme, which jeopardized sensitive applications, including support platforms for US fighter jets and other types of military aircraft, per government officials.

In a statement this week, Bryan Denny, special agent in charge of the US Department of Defense (DoD) Office of Inspector General, Defense Criminal Investigative Service in the Western Field Office, said that Aksoy “knowingly defrauded the Department of Defense by introducing counterfeit products into its supply chain that routinely failed or did not work at all.” He added:

In doing so, he sold counterfeit Cisco products to the DoD that were found on numerous military bases and in various systems, including but not limited to US Air Force F-15 and US Navy P-8 aircraft flight simulators.

The DOJ’s announcement said that Aksoy’s counterfeit devices ended up “used in highly sensitive military and governmental applications—including classified information systems—some involving combat and non-combat operations of the US Navy, US Air Force, and US Army, including platforms supporting the F-15, F-18, and F-22 fighter jets, AH-64 Apache attack helicopter, P-8 maritime patrol aircraft, and B-52 Stratofortress bomber aircraft.”

Devices purchased through the scam also wound up in hospitals and schools, the announcement said.

Counterfeit Cisco gear ended up in US military bases, used in combat operations Read More »