[ISN] Cisco says FTP feature in IOS is a hacker backdoor

From: InfoSec News (alerts@private)
Date: Mon May 14 2007 - 22:39:00 PDT


http://www.networkworld.com/news/2007/051107-cisco-ftp-ios-hacker-backdoor.html

By Phil Hochmuth
Network World
05/11/07

Cisco says a flaw in the FTP server utility in its IOS router/switch 
software could be used as a backdoor by attackers.

IOS FTP, which comes disabled by default in IOS, is used to upload IOS 
software images and other software to routers and switches remotely. 
However, Cisco says attackers could exploit a vulnerability in the FTP 
server to gain access to the file system of an IOS-based router or 
switch and affect configuration settings.

Unauthorized users could retrieve the device's startup-config file from 
the filesystem, Cisco says. This file may contain information that could 
allow the attacker to gain escalated privileges.

Cisco is offering customers software fixes with the FTP server removed 
from IOS.

In the meantime, Cisco says users should shut down IOS FTP if they are 
running the server on an affected system. (The command to do this is no 
ftp-server enable.) The company says users can upload software to IOS 
devices through other methods, such as the Secure Copy feature in the 
software. Users can also set up access control lists to restrict FTP 
access to a router or switch, Cisco adds.

The affected IOS versions are: 11.3, 12.0, 12.1, 12.2, 12.3 and 12.4. 
Ciscos IOS XR is not vulnerable, and non-IOS Cisco devices are also 
safe. Cisco says it will remove the FTP feature in IOS because of this, 
and other past issues with the code. The company says it may add a 
secure FTP server to IOS in the future.

(c) Copyright 2007 Network World Inc.


_____________________________________________________
Attend Black Hat USA, July 28-August 2 in Las Vegas, 
the world's premier technical event for ICT security 
experts. Featuring 30 hands-on training courses and 
90 Briefings presentations with lots of new content 
and new tools. Network with 4,000 delegates from 
70 nations.   Visit product displays by 30 top
sponsors in a relaxed setting. Rates increase on 
June 1 so register today. http://www.blackhat.com



This archive was generated by hypermail 2.1.3 : Mon May 14 2007 - 22:42:42 PDT