News

Denial-of-Service Worries Dominate Cisco Patching

Abandon all hope, ye who get stung by a denial-of-service attacks.

Well, almost all hope. If the latest semiannual round of security advisories from Cisco are any indication, DoS attacks continue to be a serious -- and largely unsolvable -- problem for networks.

Earlier this week, Cisco issued nine advisories for its Internetwork Operating System (IOS), the operating system software for most of the company's routers and switches. The company also issued two advisories for its Cisco Unified Communications Manager.

The advisories came as part of the company's routine half-year patching cycle. In total, the 11 advisories cover 12 potential vulnerabilities. Of the advisories Cisco issued, eight address vulnerabilities that could have left customers open to DoS attacks.

In a DoS attack, an attacker will flood a server or piece of networking equipment with packets requesting a service of one sort or another. A distributed denial-of-service (DDOS) consists of a flood of phony requests sent from multiple computers, both as a way to avoid detection and to increase the severity of the attack.

According to the advisories, attackers could down a Cisco router or switch via a DoS attack by flooding them with H.323 multimedia protocol-based packets, Network Time Protocol packets, Session Initiation Protocol packets or packets carrying requests in a number of other protocols.

The advisories note that mitigating against such attacks can be done largely by restricting the types of protocol packets that the hardware accepts to only those it requires to carry traffic. Cisco's workaround for the H.323 vulnerability, for instance, is to disable that service if the network is not carrying any traffic that uses that protocol (voice-over-IP, for instance uses H.323, as do many streaming video services). The patches being issued for these vulnerabilities, in effect, disable these protocols. Those who use these services, however, may have to look elsewhere for answers on how to fend off such attacks.

Of the remaining patches, two dealt with faults in authentication controls, and one addressed a crafty attack method of exhausting a device's security keys. For these problems, Cisco has issued patches, as well.

Since March 2008, Cisco has been releasing of non-critical security-related bug patches and advisories for IOS twice a year, in September and March. The company will release the next round of security patches on March 24, 2010.

About the Author

Joab Jackson is the chief technology editor of Government Computing News (GCN.com).

Featured

  • Windows Admin Center vs. Hyper-V Manager: What's Better for Managing VMs?

    Microsoft's preferred interface for Windows Server is Windows Admin Center, but can it really replace Hyper-V Manager for managing virtual machines? Brien compares the two management tools.

  • Microsoft Offers More Help on Windows Server 2008 Upgrades

    Microsoft this week published additional help resources for organizations stuck on Windows Server 2008, which fell out of support on Jan. 14.

  • Microsoft Ups Its Carbon Reduction Goals

    Microsoft on Thursday announced a corporatewide carbon reduction effort that aims to make the company "carbon negative" by 2030.

  • How To Dynamically Lock Down an Unattended Windows 10 PC

    One of the biggest security risks in any organization happens when a user walks away from their PC without logging out. Microsoft has the solution (and it's not a password-protected screensaver).

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.