Cisco Discloses 3 Router Security Vulnerabilities

Cisco Systems is warning of three vulnerabilities within its Internet Operating System (IOS) software that could allow a denial-of-service (DoS) attack or let a hacker run arbitrary code on an affected switch router.

The company has published workarounds and issued an updated version of the software.

The three problems are:

• TCP packet problem: A memory leak in certain versions of IOS could lead to a DoS attack, according to an advisory from the U.S. Computer Emergency Readiness Team (CERT).

• IPv6 router header vulnerability: IOS can fail to properly process IPv6 packets with specially crafted routing heads, which could allow a DoS attack or the running of arbitrary code. IPv6 is a set of specifications that enables more IP addresses to be available on the Internet.

• Crafted IP option vulnerability: This is a bug concerning how IOS processes IPv4 packets with a specially crafted IP option, CERT said. It could also enable a DoS attack or the running of arbitrary code.

CERT wrote that all three vulnerabilities could cause a device to reload its OS. In that case, a secondary, sustained DoS condition could be caused since packets won’t go through the device.

“Because devices running IOS may transmit traffic for a number of other networks, the secondary impacts of a denial of service may be severe,” CERT said.

-Jeremy Kirk, IDG News Service (London Bureau)

Check out our CIO News Alerts and Tech Informer pages for more updated news coverage.