Cisco releases security alert after Black Hat drama

Cisco said its Internetwork Operating System (IOS) Software is vulnerable to a denial-of-service attack and possibly "an arbitrary code execution attack from a specially crafted IPv6 packet" sent from a local network segment. IPv6 is the next-generation Internet Protocol.

The company said it has made free software available to its customers to address the vulnerability.

Earlier in the week, Cisco sued researcher Michael Lynn the same day he gave a presentation at the Black Hat conference in Las Vegas that showed how attackers could exploit flaws in IOS to take over routers.

Lynn went ahead with the presentation after quitting his job at Internet Security Systems, which had decided to cancel his talk. ISS and Cisco said his findings required more research before going public. Lynn said afterwards that it was critical that people understand that vulnerabilities could be exploited on the network infrastructure.

Lynn and Cisco reached a settlement Thursday, under which agreed to not further disclose the information in his presentation plus other conditions.

In its advisory, Cisco said the vulnerability affects all Cisco devices running any unfixed version of IOS code that supports and is configured for IPv6.

www.cisco.com