Cisco Discloses Controversial Hole

Cisco has released details concerning a vulnerability that affects its IOS operating system, the revelation of which stirred controversy last week.

According to Cisco's advisory, devices that have been specifically configured to process IPv6 traffic are vulnerable to denial of service (DoS) attacks, and could allow execution of arbitrary code.

Exposure of the vulnerability created some controversy last week at the annual Black Hat conference when a researcher with security firm ISS resigned his job to deliver a presentation about the vulnerability. Cisco said Michael Lynn, the former lead researcher for ISS, obtained the information for his presentation illegally. The company went so far as to have several pages ripped from a conference handbook, and obtained an injunction against Lynn to keep him from discussing the vulnerability further. Lynn has also reportedly faced FBI investigation for disclosing the hole.

At the same time, in several published reports, Cisco representatives said Lynn's presentation didn't detail any new vulnerabilities, but rather a new take on how to exploit existing and documented holes to achieve an effect Cisco had yet to report.

Security firm Secunia, nevertheless, rated the vulnerability "moderately critical". The US Computer Emergency Readiness Team (US-CERT) also has a page detailing the vulnerability.