TECH BRIEF

Denial-of-service-attack worries dominate Cisco patching

Eight of the 11 most recent Cisco advisories address denial-of-service attacks

Abandon all hope, ye who get stung by a denial-of-service attacks.

Well, almost all hope. If the latest semiannual round of security advisories from Cisco are any indication, DOS attacks continue to be a serious — and largely unsolvable — problem for networks.

Earlier this week, Cisco issued nine advisories for its Internetwork Operating System (IOS), the operating system software for most of the company's routers and switches. The company also issued two advisories for its Cisco Unified Communications Manager. The advisories came about as part of the company's routine half-year patching cycle. In total, the 11 advisories cover 12 potential vulnerabilities.

Of the vulnerabilities Cisco issued, eight address vulnerabilities that could have left customers open to denial-of-service attacks. In a DOS attack, an attacker will flood a server or piece of networking equipment with packets requesting a service of one sort or another. A distributed denial of service (DDOS) consists of a flood of phony requests sent from multiple computers, both as a way to avoid detection and to increase the severity of the attack.

According to the advisories, attackers could down a Cisco router or switch via a DOS attack by flooding them with H.323 multimedia protocol-based packets, with Network Time Protocol packets, with Session Initiation Protocol packets, or packets carrying requests in a number of other protocols.

The advisories note that mitigating against such attacks can be done largely by restricting the types of protocol packets that the hardware accepts to only those it requires to carry traffic. Cisco's workaround for the H.323 vulnerability, for instance, is to disable that service if the network is not carrying any traffic that uses that protocol (voice over IP, for instance uses H.323, as do many streaming video services). The patches being issued for these vulnerabilities, in effect, disable these protocols. Those who use these services, however, may have to look elsewhere for answers on how to fend off such attacks.

Of the remaining patches, two dealt with faults in authentication controls, and one addressed a crafty attack method of exhausting a device's security keys. For these problems, Cisco has issued patches as well.

Since March 2008, Cisco releases sets of non-critical security-related bug patches and advisories for IOS twice a year, in September and March. The company will release the next round of security patches on March 24, 2010.

About the Author

Joab Jackson is the senior technology editor for Government Computer News.

Reader Comments

Sat, Sep 26, 2009 Richard Brasil

Team, Cisco using IOS has MANY serious flaws and been this way for years.... Try Juniper solutions....they are tied more closely to what a real firewall is and does.. There are also SW on the market that can detect such attacks by PROTOCOL, thus you can limit and prevent attacks, but also Network Ops needs to understand what a attack is...and take action.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above