Cisco Discloses Controversial Hole

Cisco has released an official advisory concerning a vulnerability it sought injunctions over last week.

By Michael Hall | Posted Aug 1, 2005
Print ArticleEmail Article
  • Share on Facebook
  • Share on Twitter
  • Share on LinkedIn

Cisco has released details concerning a vulnerability that affects its IOS operating system, the revelation of which stirred controversy last week.

According to Cisco's advisory, devices that have been specifically configured to process IPv6 traffic are vulnerable to denial of service (DoS) attacks, and could allow execution of arbitrary code.

Exposure of the vulnerability created some controversy last week at the annual Black Hat conference when a researcher with security firm ISS resigned his job to deliver a presentation about the vulnerability. Cisco said Michael Lynn, the former lead researcher for ISS, obtained the information for his presentation illegally. The company went so far as to have several pages ripped from a conference handbook, and obtained an injunction against Lynn to keep him from discussing the vulnerability further. Lynn has also reportedly faced FBI investigation for disclosing the hole.

At the same time, in several published reports, Cisco representatives said Lynn's presentation didn't detail any new vulnerabilities, but rather a new take on how to exploit existing and documented holes to achieve an effect Cisco had yet to report.

Security firm Secunia, nevertheless, rated the vulnerability "moderately critical". The US Computer Emergency Readiness Team (US-CERT) also has a page detailing the vulnerability.

Comment and Contribute
(Maximum characters: 1200). You have
characters left.
Get the Latest Scoop with Enterprise Networking Planet Newsletter