Cisco flaws could damage Net
Date: September 08, 2005Source: InformationWeek
Cisco on Wednesday confirmed that routers and other devices running the newest versions of its IOS (Internetwork Operating System) are vulnerable to serious attack.
The San Jose, Calif.-based network hardware maker published a security advisory and recommended that users either upgrade to alternate editions or install fixed versions of IOS.
For its part, security giant Symantec immediately raised its overall Internet threat to "Level 2" from "1" earlier in the day. The last time Symantec had its threat set to "2" was during the Zotob attacks of August.
"Given the recent attention to exploitation of vulnerabilities in Cisco's IOS it is possible that this issue will see attempts at exploit development in the near term," wrote Symantec researchers in an alert to customers of its DeepSight Threat Management System.
In an advisory posted to its Web site, Cisco warned that its IOS Firewall Authentication Proxy for FTP and Telnet Sessions is vulnerable to a remotely-exploitable buffer overflow flaw. The company said devices that aren't configured for or don't support the feature aren't vulnerable, neither are devices configured with only Authentication Proxy for HTTP and/or HTTPS.
According to Cisco, the affected versions of IOS include versions 12.2ZH, 12.2ZL, 12.3, 12.3T, 12.4 and 12.4T. Products running IOS version 12.2 or lower or IOS XR are not affected. Users can determine the version number on their equipment by using the show version command at the prompt.
Cisco says that malicious people exploiting the flaw could force the device to reload, creating a denial of service condition; or they could execute arbitrary code on the device.
Add comment
Email to a Friend
| Discussion is closed - view comments archieve |
| 2006-10-12 03:11:07 - Life insurance Cheap life insurance |
| Total 1 comments |
