Cisco Addresses Flaws in IOS

Cisco is providing patches for its popular Internetwork Operating System in response to the discovery of three flaws, the most serious of which would allow hackers to insert malicious code in order to corrupt devices running IOS.

The company addressed the flaws in a series of advisories released Jan. 24.

According to Cisco officials, the companys IOS TCP listener in some versions of the IOS software is vulnerable to a memory leak that could be exploited to cause a DoS (denial-of-service) attack.

/zimages/3/28571.gifClick hereto read about a previous IOS flaw, revealed at the Black Hat Briefings.

Another vulnerability exists in the way Cisco IOS processes a number of different types of IPv4 packets containing a specially crafted IP option, and a third deals with IOS failure to properly process IPv6 packets with specially crafted routing headers. Successful exploitation of these last two flaws could lead to a denial-of-service condition or the launching of arbitrary code.

In each of the advisories, the company states that it is “not aware of any public announcements or malicious use of the vulnerability described in this advisory.” Cisco officials could not immediately be reached for further comment.

Andrew Storm, director of security operations for San Francisco-based nCircle Network Security, said the flaws should be taken seriously—if for no other reason than because of how widely used IOS is.

“It took me probably a good hour yesterday to find a version for my router that wasnt vulnerable,” he said. “Thats a daunting task when you extrapolate that to larger enterprises.”

He said the workarounds proposed by Cisco, such as turning on “IP options drop,” should already be part of an enterprises standard operating procedures. If they arent, then most likely it is because following those steps may impair functionality in areas critical to the business, he said.

/zimages/3/28571.gifFor advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis InternetsSecurity IT Hub.

The advisories by Cisco led to a warning by the U.S. Computer Emergency Readiness Team that “repeated exploitation of these vulnerabilities may result in a sustained denial-of-service condition. … Because devices running IOS may transmit traffic for a number of other networks, the secondary impacts of a denial of service may be severe.”

/zimages/3/28571.gifCheck out eWEEK.coms for the latest news, views and analysis on servers, switches and networking protocols for the enterprise and small businesses.