Feeds

Security software crashes Cisco kit

Doh! Problems at Borg Central get sillier by the day

  • alert
  • submit to reddit

High performance access to file storage

Probing Cisco's networking equipment with vulnerability scanning software is liable to crash its boxes, the networking giant has been forced to admit.

The problem, which is due to a flaw in the design of Cisco's IOS (Internetwork Operating System) software, can be exploited to produce a consistent denial of service (DoS) attack.

Cisco has advised customers using affected IOS software - 12.1(2)T and 12.1(3)T - to upgrade to later versions of the software, which it has promised to make freely available. The issue affects a large number of Cisco's router products and some of its LAN switches. More information on the issue is available here.

The DoS aspect of the flaw was discovered by what Cisco describes as "many" of its customers who uncovered the bug while conducting security scans of their networks. Despite this Cisco said it is yet to receive reports of malicious exploitation of the problem.

In its security notice Cisco stated: "Security scanning software can cause a memory error in Cisco IOS Software that will cause a reload to occur. The described defect can be used to mount a denial of service (DoS) attack on any vulnerable Cisco product."

Gunter Ollman, principal consultant at Internet Security Systems, which markets vulnerability scanning software, said that just about any vulnerability scanner would include a port scanner.

He added that the ports associated with the IOS bug are used by Trojan horse programs and would therefore routinely be scanned when a customer decided to audit the security of a network.

It's unclear how widely deployed affected products are but Ollman suggested that the defect was so obvious that it couldn't have gone unnoticed for long. He believes that upgrading an affected device is relatively straightforward but admits that this is just an educated guess on his part.

Last June, different versions of IOS were discovered to be subject to an eerily similar type of denial of service vulnerability which, like the latest bug, could be triggered by security scanning software. This would appear to call for a rewrite of this part of the software and we'd dearly love to quiz Cisco on this.

Unfortunately Cisco hasn't responded to our offer of cash for interviews. From a number of emails I've received from Register readers about their attempts to gain advice on patching up security holes with 600 series routers, it seems like the Borg aren't talking to their customers either. All enquiries are been referred to the users' service providers.

I've been paid today and am prepared to dip into my pocket for a chance to properly quiz Borg Central on this. Any payment must not conflict with my ability to pay for a round at the bar tonight. After all it is bank holiday weekend and some things are sacred... ®

External Links

Security Advisory: IOS Reload after Scanning Vulnerability

Related Stories

Multiple flaws in Cisco router software exposed
Cisco 600 routers offer cracker fun
Cisco routers vulnerable to easy attack

High performance access to file storage

More from The Register

next story
Seagate brings out 6TB HDD, did not need NO STEENKIN' SHINGLES
Or helium filling either, according to reports
European Court of Justice rips up Data Retention Directive
Rules 'interfering' measure to be 'invalid'
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Cisco reps flog Whiptail's Invicta arrays against EMC and Pure
Storage reseller report reveals who's selling what
Bored with trading oil and gold? Why not flog some CLOUD servers?
Chicago Mercantile Exchange plans cloud spot exchange
Just what could be inside Dropbox's new 'Home For Life'?
Biz apps, messaging, photos, email, more storage – sorry, did you think there would be cake?
IT bods: How long does it take YOU to train up on new tech?
I'll leave my arrays to do the hard work, if you don't mind
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.