News

Denial-of-Service Worries Dominate Cisco Patching

Abandon all hope, ye who get stung by a denial-of-service attacks.

Well, almost all hope. If the latest semiannual round of security advisories from Cisco are any indication, DoS attacks continue to be a serious -- and largely unsolvable -- problem for networks.

Earlier this week, Cisco issued nine advisories for its Internetwork Operating System (IOS), the operating system software for most of the company's routers and switches. The company also issued two advisories for its Cisco Unified Communications Manager.

The advisories came as part of the company's routine half-year patching cycle. In total, the 11 advisories cover 12 potential vulnerabilities. Of the advisories Cisco issued, eight address vulnerabilities that could have left customers open to DoS attacks.

In a DoS attack, an attacker will flood a server or piece of networking equipment with packets requesting a service of one sort or another. A distributed denial-of-service (DDOS) consists of a flood of phony requests sent from multiple computers, both as a way to avoid detection and to increase the severity of the attack.

According to the advisories, attackers could down a Cisco router or switch via a DoS attack by flooding them with H.323 multimedia protocol-based packets, Network Time Protocol packets, Session Initiation Protocol packets or packets carrying requests in a number of other protocols.

The advisories note that mitigating against such attacks can be done largely by restricting the types of protocol packets that the hardware accepts to only those it requires to carry traffic. Cisco's workaround for the H.323 vulnerability, for instance, is to disable that service if the network is not carrying any traffic that uses that protocol (voice-over-IP, for instance uses H.323, as do many streaming video services). The patches being issued for these vulnerabilities, in effect, disable these protocols. Those who use these services, however, may have to look elsewhere for answers on how to fend off such attacks.

Of the remaining patches, two dealt with faults in authentication controls, and one addressed a crafty attack method of exhausting a device's security keys. For these problems, Cisco has issued patches, as well.

Since March 2008, Cisco has been releasing of non-critical security-related bug patches and advisories for IOS twice a year, in September and March. The company will release the next round of security patches on March 24, 2010.

About the Author

Joab Jackson is the chief technology editor of Government Computing News (GCN.com).

Featured

  • Exploring OCR, a New Way To Get Data into Excel

    Microsoft recently added a new optical character recognition feature to Excel that lets users import data from a photograph taken from a smartphone. Here's how to use it.

  • Microsoft Authenticator App To Get Real-Time Phishing Protections

    Microsoft is working on adding capabilities to its Microsoft Authenticator app to help defeat security breaches enabled by advanced attack techniques, including phishing and man-in-the-middle methods.

  • A Quicker Way To Create Hyper-V Inventory Reports

    If you need to generate Hyper-V inventory reports but don't want the hassle of writing your own custom PowerShell script, here is a shortcut.

  • Microsoft Previews New Azure Active Directory Roles and Bulk Management Capability

    Microsoft this week announced a couple of noteworthy previews of new capabilities for IT pros using the Azure Active Directory identity and access management service.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.