The Register® — Biting the hand that feeds IT

Cisco breaks cycle with IOS patch

Preemptive defence against rootkit exploits?

Free whitepaper – Comparison of Static and Rotary UPS

Cisco released a trio of updates on Wednesday. The advisories cover denial of service vulnerabilities in IOS Secure Shell and its Secure Control Engine software. The escalation update involves Cisco's voice engine portal software.

The network giant states that it discovered all three vulnerabilities itself but the timing of the releases, on the day before Sebastian Muniz of CORE Security demoed proof of concept router rootkit software, may be more than simply coincidental. As researchers at the SANS Institute's Internet Storm Centre note, the IOS Secure Shell bug allows "spurious memory access".

"Anytime we see a 'spurious memory access' leading to a denial of service, thoughts immediately go to arbitrary code execution. There is no evidence that this is possible, but in light of the recent work in IOS rootkits, vulns in Cisco devices should not be taken lightly," writes ISC staffer George Bakos.

Cisco launched a twice-yearly patching cycle for IOS vulnerabilities back in March. The IOS Secure Shell falls outside this cycle, providing further fuel for conspiracy theorists.

Cisco's advisories can be found here, here and here. ®

Free whitepaper – Comparison of Static and Rotary UPS

Don’t Miss

Imation logosImation notebook flash upgrade as easy as pi to 30 places

This isn't rocket science... it's brain surgery!

CloudWrecking CRU: hackers cause massive climate data breach

Secretive scientists' source code goes walkabout

Apple iMacApple voids warranties over cigarette smoke, users say

No repairs for 'biohazard' Macs

O/S bloat: What's the cure?

Comment Code belly's gonna get you