Ahead of rootkit talk, Cisco patches router flaw

Cisco has issued patches for several products including the SSH server software used by its routers

Cisco has issued three security patches, fixing bugs that could crash its products and drawing a warning from the SANS Internet Storm Center.

The updates, issued Wednesday, fix denial of service bugs in the SSH (Secure Shell) software in Cisco's Internetwork Operating System (IOS), used to power its routers, and in the Cisco Service Control Engine, which is provides carrier-grade networking services.

Cisco has also patched a privilege escalation vulnerability in its Voice Portal automated telephone customer service software.

In its security advisories Cisco said that all of the bugs had been discovered by its own researchers, but SANS warned that researchers are likely reverse-engineering the patches and may release exploit code publicly.

These particular updates are getting extra attention from the security community, which is now closely investigating how malicious software might work on IOS, an operating system that has largely evaded serious scrutiny. On Thursday, for example, Core Security's Sebastian Muniz is slated to give a widely anticipated presentation on a Cisco rootkit he calls the DIK (Da Ios rootKit) at the EuSecWestconference in London.

Cisco recently changed its software update policy, saying it will now only issue IOS patches in March and September each year, unless forced to rush out a fix for serious bugs that were publicly disclosed or which were being actively exploited. On Wednesday, a Cisco spokesman couldn't immediately say whether his company considered the IOS patch, which fixes a flaw in the SSH server, an out-of-cycle update.

But Core Security Chief Technology Officer Ivan Arce said that Cisco's SSH bug-fix was not connected to his company's rootkit presentation. "It is more likely that this is related to an ongoing distributed SSH brute forcing attack that a few people reported in the incidents mailing list last week," he said in an e-mail interview.

The SSH server is used by administers to remotely log into a router using encryption. Bugs in the software could let an attacker repeatedly reload the device or access "spurious" parts of the router's memory and could be used to disable the hardware in a Denial of Service (DoS) attack, Cisco said in its advisory.

"While the 'Exploitation and Public Announcements' portion of all three advisories states that the vulns were discovered in-house, it's a pretty safe bet that a fair number of security researchers are feverishly reverse engineering the updates to develop exploits," wrote SANS Internet Storm Center contributor George Bakos in a blog posting.

"Anytime we see a 'spurious memory access' leading to a denial of service, thoughts immediately go to arbitrary code execution. There is no evidence that this is possible, but in light of the recent work in IOS rootkits, vulns in Cisco devices should not be taken lightly," he wrote.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?