Cisco Gear Vulnerable To Denial Of Service, Intrusion Attacks

Company announces two new Internetwork Operating System (IOS) security holes, and posts fixes.

April 9, 2005

1 Min Read
Network Computing logo

Cisco this week revealed two newly discovered IOS security holes, one of which allows IOS-based Cisco devices to be subject to Denial of Service (DoS) attacks, and the other of which allows intruders unauthorized access to a network.

The vulnerability which allows intruders into a network may allow an attacker to doctor and send special packets, called Internet Key Exchange (IKE) Xauth messages, to a router configured as an Easy VPN Server, and then gain access to a network and its resources. The vulnerability only affects IOS-based devices that are running IOS Easy VPN Server.

The DoS vulnerability affects routers and other IOS devices running Secure Shell (SSH) servers for remote management. Attackers could exploit this hole in a variety of ways, including exploiting a memory leak, and sending commands causing the router to reload. The vulnerability affects IOS-based devices running SSH version 2.

Cisco has released patches that fix the vulnerabilities.

SUBSCRIBE TO OUR NEWSLETTER
Stay informed! Sign up to get expert advice and insight delivered direct to your inbox

You May Also Like


More Insights