Cisco Warns of Security Flaw in Routers

Just hours after security experts revealed a new attack capable of taking down any device receiving TCP requests, Cisco Systems Inc. said that a large portion of its routers and switches contain a serious software flaw that also could be used by attackers to knock those devices offline.

/zimages/4/28571.gifClick herefor an analysis of the TCP problem.

The vulnerability is in Ciscos implementation of the SNMP in the IOS (Internetwork Operating System) software that runs much of the companys ubiquitous networking equipment. When attempting to process some certain types of SNMP requests, the software mishandles the messages and resets the device. As a result, an attacker could repeatedly exploit the vulnerability to cause a DoS (denial of service) condition on any vulnerable device.

Whats more, the attacker need not be authenticated in order to execute the attack.

SNMP is used to send messages to remote machines for control and management purposes. The messages are sent via UDP (User Datagram Protocol), typically over ports 161 or 162. But Ciscos implementation of SNMP also uses some randomly chosen ports between 49152 and 59152 to receive some types of SNMP messages.

/zimages/4/28571.gifFor insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzers Weblog.

There are some methods for mitigating the effects of this flaw for messages using SNMPv1 and SNMPv2c. However, any SNMPv3 message sent to a vulnerable machine will reset the device, according to a bulletin published Tuesday by the US-CERT.

The vulnerability affects numerous versions of IOS, ranging from 12.0 through 12.3. Cisco, based in San Jose, Calif., is in the process of producing fixed versions of all of the vulnerable releases.

Earlier Tuesday, US-CERT and other organizations warned of a new attack that a security researcher has developed to exploit a known problem in the TCP protocol. The attack can be used to cause a DoS on devices that accept TCP connections, including routers.

/zimages/4/28571.gifCheck outeWEEK.coms Security Centerat http://security.eweek.com for security news, views and analysis.
Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page:http://us.i1.yimg.com/us.yimg.com/i/us/my/addtomyyahoo2.gif