Cisco Addresses Flaws in IOSBy Brian Prince | Posted 2007-01-25 Email Print
WEBINAR: On-demand webcast
Take Advantage of Cloud Backup to Kick-Start Your Disaster Recovery REGISTER >
The company provides patches for three flaws that had left the widely used operating system vulnerable to attack.Cisco is providing patches for its popular Internetwork Operating System in response to the discovery of three flaws, the most serious of which would allow hackers to insert malicious code in order to corrupt devices running IOS.
The company addressed the flaws in a series of advisories released Jan. 24.
According to Cisco officials, the company's IOS TCP listener in some versions of the IOS software is vulnerable to a memory leak that could be exploited to cause a DoS (denial-of-service) attack.
In each of the advisories, the company states that it is "not aware of any public announcements or malicious use of the vulnerability described in this advisory." Cisco officials could not immediately be reached for further comment.
Andrew Storm, director of security operations for San Francisco-based nCircle Network Security, said the flaws should be taken seriouslyif for no other reason than because of how widely used IOS is.
"It took me probably a good hour yesterday to find a version for my router that wasn't vulnerable," he said. "That's a daunting task when you extrapolate that to larger enterprises."
He said the workarounds proposed by Cisco, such as turning on "IP options drop," should already be part of an enterprise's standard operating procedures. If they aren't, then most likely it is because following those steps may impair functionality in areas critical to the business, he said.
The advisories by Cisco led to a warning by the U.S. Computer Emergency Readiness Team that "repeated exploitation of these vulnerabilities may result in a sustained denial-of-service condition. Because devices running IOS may transmit traffic for a number of other networks, the secondary impacts of a denial of service may be severe."
Check out eWEEK.com's for the latest news, views and analysis on servers, switches and networking protocols for the enterprise and small businesses.