Cisco bits network device driver vulnerabilities

Yesterday (November 2), Cisco Systems has just sealed an important security hole in the router control software (router) and network switch (switch) software.

This time, the world's leading network equipment manufacturer has released an update to patch the buffer overflow vulnerability in software that controls the Internetwork Operating System network device - a common security flaw in parts. soft.

However, this error is also very dangerous because it allows the remote attacker to gain control of the faulty system. In this case, gain control of Cisco's network switches and orientations - the infrastructure of an entire computer network including the Internet.

In fact, the security bug in this patched iOS has been announced at the Black Hat security forum last July. But Cisco has kept it secret until today.

At Black Hat forum, security researcher Michael Lynn demonstrated the ability to take control of the routers by exploiting security flaws in the control software. And if this security bug is exploited for a large-scale attack, the consequences will be incalculable - which may cause the Internet computer network or a business to stop working.

John Noh, a Cisco spokesman, said: ' Lynn took advantage of the IPv6 vulnerability that was released last July to conduct a buffer overflow attack on the system timer. . This error Cisco has patched in April but Lynn can still take advantage to attack and control routers . '

The truth is that in July Cisco released details of the security breach in IPv6 - an error Lynn used to demonstrate at the Black Hat forum. But there is still a more dangerous error that the developer does not publish. It was not until yesterday that the user knew of this error.

It can be seen that the scope of this vulnerability is too great to force Cisco to remain silent, Johannes Ullrich, chief research officer of the SANS Research Institute, expressed his views. ' The dangerous nature of these security flaws is the answer why Cisco must keep it secret from the public at Black Hat. If we all know about this security error, the consequences can be unpredictable . ' Ullrich recommends that users proceed to update device drivers as soon as possible.

In addition to patching the buffer overflow vulnerability, Cisco also enhances the security barrier for this software. The new software version has added a variety of integrity checks to detect and prevent future attacks.

Cisco said that after the company released details of the security flaw, the company did not fear that the bug could be exploited to organize attacks. The update for all IOS versions is now available for download on the manufacturer's website.

HVD - ( CNet )