Important article on ZDNet for any network running on Cisco hardare:

Three security holes in the software that runs Cisco Systems’ routers and switches could let miscreants disrupt computer networks, including the Internet.

The vulnerabilities lie in Cisco’s Internetwork Operating System and could be exploited to crash or remotely run malicious code on devices that run the software, the San Jose, Calif., networking giant warned Wednesday in security advisories. IOS runs on Cisco’s routers and switches, which make up a large portion of the Internet’s infrastructure.

Cisco’s warning prompted the U.S. Computer Emergency Readiness Team, or US-CERT, to issue an alert. “A remote attacker may be able to execute arbitrary code on an affected device, cause an affected device to reload the operating system, or cause other types of denial of service,” US-CERT said on it Web site.

Being able to execute arbitrary code means that an attacker could change the configuration of a router or switch, redirecting traffic or potentially sniffing the data that travels through a Cisco device. In a denial-of-service attack a vulnerable router or switch would be taken offline, disrupting any traffic it is tasked to channel.

“Because devices running IOS may transmit traffic for a number of other networks, the secondary impacts of a denial of service may be severe,” US-CERT said.

The impact of each of the three vulnerabilities is different. The most serious of the problems, which relates to how IOS handles specific data packets, affects a broad range of Cisco devices. This includes routers and switches used by telecommunications companies that use Cisco’s gear to shuttle data traffic across networks.

“These are serious issues and patches need to be applied as soon as possible,” said Gunter Ollmann, director of security strategy for IBM Internet Security Systems. “From our monitoring of underground channels there are a lot of people interested in these and actively working on exploits.”

Cisco has software updates available to address the vulnerabilities, the company said in each of its alerts. “Cisco is also not aware of any current exploitation of these vulnerabilities,” the company added.

Will Sturgeon of Silicon.com in London contributed to this story.

Share This

Here’s some information on the 2007 RSA Conference held in SF from Feb. 5-9 at Moscone Center. In case you didn’t know, “RSA” is a security encryption code created in 1977, and named after the inventors. Today it is the world’s most widely distributed code! This conference features a ton of IT security leaders from companies like Cisco and Microsoft., disucssing new developments and leading insights. You can also take an one of the 220 sessions on topics ranging from Applied Security Case Studies to Wireless. Cost of the full conference: $1,995. The feling of knowing your network is secure: priceless.

Here’s a snippit from the RSA site:

Whether you’re planning to attend the full week or a day or two, RSA® Conference 2007 delivers extraordinary opportunities to expand your knowledge, hone your skills, and grow your personal network of industry peers and influencers.

Knowledge and best-practice sharing are at the heart of RSA® Conference. You’ll have a chance to build a customized agenda from the 220 available sessions — ranging from keynotes to breakout sessions to tutorials — across different class tracks. There are sessions and tutorials designed for all facets of information security, IT management, programming/development and executive management, as well as virtually every leading topic in the field — cryptography to consumer protection to legislation, government and policy mandates.

These range from the First-Time Attendee Orientation, Welcome and Networking Reception and topic-driven Peer2Peer Sessions to the renowned RSA® Conference Codebreakers Bash, Town Hall Meetings and the Interactive Testing Challenge – among many others.

The latest products, technologies and solutions are also prominently featured at the Expo where 340+ information security companies — Fortune 500 to start-up — will showcase their latest innovations.

RSA Conference would like to thank the 2007 Program Committee for its help in selecting speakers and topics that make up the dynamic agenda. Members of the Program Committee are representatives from financial institutions, retail industries, trade publications, training organizations, security vendors, academia, and federal and state governments.

The members of the Program Committee include Ilieva I. Ageenko, PhD, CISA, of Wachovia Corporation; Illena Armstrong of SC Magazine; Asheem Chandna of Greylock Partners; David B. Cross of Microsoft Corporation; Bruce Gossard of Cisco Systems; Vincent Gullotto of Microsoft Corporation; Bret Hartman of EMC; Daniel Houser of Huntington Bank; Sally Hudson of IDC; Andrew Jaquith of Yankee Group; Benjamin Jun of Cryptography Research; Shannon Kellogg of EMC; Sandra Lambert of Lambert & Associates, LLC; James Lewis of the Center for Strategic and International Studies; Ron Moritz of Computer Associates; Andrew Nash formerly of Reactivity; Randy V. Sabett, J.D., CISSP, of Cooley Godward LLP; John R. Schramm, CISA, CISSP, of Fidelity Investments; Kurt Stammberger of Healthia; Jon Stanley of The Law Firm of Jon Stanley and Associates; Herbert H. Thompson, Ph.D., of Security Innovation; Michael Vergara of PayPal; and Ed Zeitler, CISSP, of (ISC)2.

Share This

Odds are someone you know is watching You Tube or Google Video right now. But behind the explosive growth of the online video market are the cisco hardware providers that power these bandwidth intensive networks. As the demand to house and serve videos increases, the $1.3 Billion online video industry is upgrading networks at an unprecidented rate to keep up with network demands. Cisco servers, swicthes, and routers help service providers manage the massive amounts of data and traffic that are transered through their network. Look for Cisco to post 20% revenue growth in the current year. Also, expect the sale of used Cisco hardware to increase in kind. If I was a betting man, I’d add Cisco to my investment portfolio right next to my Google holdings.

PS. Oh, and we buy used Cisco hardware. So if you are upgrading your network, or have nay surplus gear you need to sell, call or send us an email.

Share This