Cisco warns of flaw in its software

Cisco Systems has issued an alert about a flaw in its Internetwork Operating System (IOS) software that could allow an attacker to launch a denial-of-service or execute remote code on Cisco devices.

The flaw affects the Firewall Authentication Proxy for FTP and/or Telnet sessions feature in specific versions of IOS software.

"Cisco IOS software is vulnerable to a denial-of-service and potentially an arbitrary code execution attack when processing the user authentication credentials from an Authentication Proxy Telnet/FTP session," Cisco said in its advisory.

"To exploit this vulnerability an attacker must first complete a TCP connection to the IOS device running affected software and receive an auth-proxy authentication prompt."

Cisco said it is unaware of any exploits for the vulnerability.

The company has patches available to fix the flaw and also offered workarounds for it.

Earlier this summer, Cisco was the center of controversy at the Black Hat conference when a researcher, Michael Lynn, gave a presentation that showed how attackers could exploit flaws in Cisco software. Cisco sued Lynn, who agreed to a permanent injunction that prevents him from further disclosing his presentation.

<a href=''>

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.