Cisco releases security alert after Black Hat drama

Cisco Systems on Friday released a security alert about a vulnerability in its router software, two days after taking legal action against a researcher who exposed the flaw at the Black Hat conference.

Cisco said its Internetwork Operating System (IOS) Software is vulnerable to a denial-of-service attack and possibly "an arbitrary code execution attack from a specially crafted IPv6 packet" sent from a local network segment. IPv6 is the next-generation Internet Protocol.

The company said it has made free software available to its customers to address the vulnerability.

Earlier in the week, Cisco sued researcher Michael Lynn the same day he gave a presentation at the Black Hat conference in Las Vegas that showed how attackers could exploit flaws in IOS to take over routers.

Lynn went ahead with the presentation after quitting his job at Internet Security Systems, which had decided to cancel his talk. ISS and Cisco said his findings required more research before going public. Lynn said afterwards that it was critical that people understand that vulnerabilities could be exploited on the network infrastructure.

Lynn and Cisco reached a settlement Thursday, under which agreed to not further disclose the information in his presentation plus other conditions.

In its advisory, Cisco said the vulnerability affects all Cisco devices running any unfixed version of IOS code that supports and is configured for IPv6.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.