Cisco details controversial router flaw

TalkBack 1 of 11:

Next »

• Thread View
• Flat View

Would you hire ISS for security advice?

" The companies went to court seeking a gag order against Lynn and the Black Hat organizers. "

ISS are really damaging their own reputation here.
Here, from ISS website:

"Internet Security Systems (ISS) has served as the trusted security advisor to global enterprises and world governments for over a decade."

So if I was a government agency and I found out that ISS knew about a security hole in Cisco routers, that Cisco were told about in April and didn't properly correct it. That ISS colluded with Cisco in keeping this information secret....I don't think I would seek advice from these guys do you?

What he did was correct. A crap lock is a crap lock is a crap lock. Pretending a crap lock is really a good lock and hoping the thieves will be fooled is no security.

http://www.boingboing.net/2005/07/27/security_researcher_.html

"In the latest case, ISS and Lynn contacted Cisco in April to report their process for using a vulnerability in IOS to run a program on a Cisco router. The networking fixed the vulnerability in the operating system, but did nothing to prevent attackers from running programs on the devices using the broad techniques Lynn described, the researcher said.

"During his presentation, Lynn outlined an eight step process using any known, but unpatched flaw, to compromise a Cisco IOS-based router. While he did not publish any vulnerabilities, Lynn said that finding new flaws would not be hard... "

Posted by: Nigel Johnstone   Posted on: 07/29/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• Five Steps to Determine When to Virtualize YourServers VMware Server virtualization isn't just for big companies. Entry-level ... Download Now
• SOA for Dummies 2nd IBM Limited Edition Mini eBook IBM Learn the basics of SOA by following 7 real-life companies as they experience the truly game-changing effects of this important technology initiative. Download Now