By Phil Hochmuth
Cisco says a flaw in the FTP server utility in its IOS router/switch
software could be used as a backdoor by attackers.
IOS FTP, which comes disabled by default in IOS, is used to upload IOS
software images and other software to routers and switches remotely.
However, Cisco says attackers could exploit a vulnerability in the FTP
server to gain access to the file system of an IOS-based router or
switch and affect configuration settings.
Unauthorized users could retrieve the device's startup-config file from
the filesystem, Cisco says. This file may contain information that could
allow the attacker to gain escalated privileges.
Cisco is offering customers software fixes with the FTP server removed
In the meantime, Cisco says users should shut down IOS FTP if they are
running the server on an affected system. (The command to do this is no
ftp-server enable.) The company says users can upload software to IOS
devices through other methods, such as the Secure Copy feature in the
software. Users can also set up access control lists to restrict FTP
access to a router or switch, Cisco adds.
The affected IOS versions are: 11.3, 12.0, 12.1, 12.2, 12.3 and 12.4.
Ciscos IOS XR is not vulnerable, and non-IOS Cisco devices are also
safe. Cisco says it will remove the FTP feature in IOS because of this,
and other past issues with the code. The company says it may add a
secure FTP server to IOS in the future.
(c) Copyright 2007 Network World Inc.
Attend Black Hat USA, July 28-August 2 in Las Vegas,
the world's premier technical event for ICT security
experts. Featuring 30 hands-on training courses and
90 Briefings presentations with lots of new content
and new tools. Network with 4,000 delegates from
70 nations. Visit product displays by 30 top
sponsors in a relaxed setting. Rates increase on
June 1 so register today. http://www.blackhat.com