Cisco security updates squash router bugs

Networking giant updates the security in the software powering its routers

Cisco has released eight security updates for the Internetwork Operating System (IOS) software used to power its routers.

The patches were released Wednesday, the day Cisco had previously scheduled for its twice-yearly IOS updates. None of the bugs had been publicly disclosed ahead of Wednesday's updates, but some of them were reported to Cisco by outside sources.

The eight updates fix 11 security vulnerabilities, according to Jean Reese, senior manager with Cisco's Product Security Incident Response Team.

Most of the bugs could be exploited by attackers to crash or somehow disrupt service to a router, typically if a specific, vulnerable service is enabled, Cisco said.

For example, Cisco has fixed two bugs in its SSLVPN (Secure Sockets Layer Virtual Private Network) software that could be used to crash the device. Attackers could exploit one of these bugs by sending a specially crafted HTTPS packet to the router. The bug does not affect users of the company's ASA 5500 appliance or of Cisco IOS XR or XE software, however.

SSLVPN lets users outside of the corporate firewall access their company's network using a Web browser, instead of installing special VPN software on their PC.

Another serious bug affects those who have enabled the Secure Copy Protocol (SCP), used to allow file transfers over the network. Because of this bug, an authenticated user on the device could "transfer files to and from a Cisco IOS device that is configured to be an SCP server, regardless of what users are authorized to do," Cisco said in its advisory. This could allow a user to mess with the router's configuration files or sneak a peek at passwords, Cisco said. This bug was reported to Cisco by Kevin Graham, the company said.

For the bug to be exploited, the Cisco user would need to have a command line interface (CLI) on the router. "The SCP bug is pretty bad if you have read-only CLI users," said Felix Lindner, a noted Cisco expert who is head of Recurity Labs, in an e-mail interview. "If you are a read-only CLI user and this bug allows you to write the configuration or, even worse, a new backdoored IOS image. That's evil."

According to sources familiar with the matter, Cisco and other vendors have been working on patching a major TCP/IP bug in its routers that could be exploited in what's called a Sockstress attack. This flaw, which has not been disclosed publicly, could be used to take down a router using a very low-bandwidth denial of service attack.

Reese wouldn't comment on whether this bug was patched in Wednesday's updates. The company did not credit the two researchers who first discussed the Sockstress attack in any of its updates, a sign that the issue may not have been patched.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags cisco

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service/San Francisco Bureau
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?