NCC advises users on exposure to multiple vulnerabilities in Cisco products
As part of measures to improve the state of broadband in the country, the Nigerian Communications Commission (NCC) has inaugurated an industry-wide committee to facilitate the deployment of broadband infrastructure under a project named, National Communications Backbone (NCB).
Chaired by NCC’s Director of Digital Economy, Dr. Augustine Nwaulune, the committee has Mobile Network Operators (MNOs), Infrastructure Companies (InfraCos), and Tower Companies (TowerCos) as members.
The Committee, christened the National Broadband Infrastructure Joint Committee (NBIJC), is saddled with the responsibility of supporting the drive towards the realisation of the NCB targets, as outlined in the Nigerian National Broadband Plan (NNBP) 2020-2025.
The Committee, in collaboration with the Commission, is expected to organise an NCB financing workshop and invite all the major financial institutions, MNOs and InfraCos, and present the project, estimated at N800 billion, for adoption and financing.
Director of Legal and Regulatory Services at NCC, Josephine Amuwa, who presided over the inauguration on behalf of the Executive Vice Chairman (EVC) of NCC, Prof. Umar Danbatta, in Abuja, said the emergence of the Committee was informed by the need to inject a broad-based industry approach to address challenges impeding the actualisation of broadband targets.
Danbatta said the Committee is expected to drive the targets set by the NNBP, including deployment of 120,000 kilometer of fibre across the country; deepening of broadband penetration to 70 per cent by 2025; and connection of 60 per cent of Communication towers with fibre; among other targets, as stipulated in its approved Terms of Reference (ToR).
The EVC stated, “I appreciate your willingness and readiness to make a considerable investment of time and talent to participate in this Committee. We appreciate that you will provide an invaluable perspective as we seek to address gaps impeding the actualisation of the NCB and NNBP initiatives.”
“The depth and scope of experiences represented by the broad spectrum of this Committee’s membership will, no doubt, provide the Commission with much-needed insight and drive to overcome the challenges facing broadband infrastructure deployment in the country, and even exceed the current set targets.”
The Committee’s six-point ToR include: enhancing collaboration between MNOs and InfraCos towards achieving target of the NCB of the NNBP 2020-2025; and to design an NCB network architecture and harmonized comprehensive plan that will create a more viable business case that will attract investors, establish synergy between the MNOs and the InfraCos, and facilitate infrastructure deployment.
Equally, the Committee is mandated to initiate engagements with identified sources of funding including Nigeria Sovereign Investment Authority (NSIA), Infrastructure Corporation of Nigeria (InfraCorp), Africa Development Bank (AfDB), and Central Bank of Nigeria (CBN) among others.
MEANWHILE, the Nigerian Communications Commission’s Computer Security Incident Response Team (NCC-CSIRT) has issued an advisory for users to frequently review alerts for Cisco products to assess their exposure and find a comprehensive update solution.
The advisory, which also recommended using the appropriate software updates that are accessible from the vendor’s website, followed the identification of multiple vulnerabilities in Cisco Products, especially the Cisco AnyConnect Secure Mobility Client for Windows, which enables employees to access company servers from anywhere without compromising security.
NCC, in a statement, signed by the Director of Public Affairs, Reuben Muoka, said the two vulnerabilities made it possible for a remote attacker exploit to trigger remote code execution and data manipulation on the targeted system.
According to the advisory, “The weaknesses in the product include uncontrolled search path and Dynamic Link Library (DLL) hijacking vulnerabilities. The uncontrolled search path vulnerability results from incorrect handling of directory paths. A directory path is a string of characters used to uniquely identify a location in a folder structure.
“This flaw could be exploited by an attacker by generating a malicious file and copying it to a system directory (folder). An exploit could enable the attacker to copy malicious files with system-level privileges to any location. The attacker needs legitimate Windows system credentials to exploit this vulnerability.
“Moreover, to exploit the DLL hijacking vulnerability, the attacker would also need to have valid credentials on the Windows system. The vulnerability was caused by the device’s inadequate run-time resource validation. By sending the AnyConnect process a specially designed IPC message, an attacker might take advantage of this vulnerability.”
The advisory rated the vulnerability high in impact and probability.
