Cisco Gear Vulnerable To Denial Of Service, Intrusion Attacks

Cisco this week revealed two newly discovered IOS security holes, one of which allows IOS-based Cisco devices to be subject to Denial of Service (DoS) attacks, and the other of which allows intruders unauthorized access to a network.

The vulnerability which allows intruders into a network may allow an attacker to doctor and send special packets, called Internet Key Exchange (IKE) Xauth messages, to a router configured as an Easy VPN Server, and then gain access to a network and its resources. The vulnerability only affects IOS-based devices that are running IOS Easy VPN Server.

The DoS vulnerability affects routers and other IOS devices running Secure Shell (SSH) servers for remote management. Attackers could exploit this hole in a variety of ways, including exploiting a memory leak, and sending commands causing the router to reload. The vulnerability affects IOS-based devices running SSH version 2.

Cisco has released patches that fix the vulnerabilities.