Cisco admits security blunder

Cisco has warned systems administrators that all releases of its IOS software - the primary control program used in its routers - present a security vulnerability to remote intruders.

The problem affects the http server component of a Cisco IOS system when linked to a local authentication database. This can allow malicious users to remotely execute commands on the system at the highest privilege level, effectively controlling the device.

IT staff are being urged to disable the http server on the router or to use Terminal Access Controller Access Control System (TACACS+) or Radius for authentication.

More details and solutions can be found by visiting the security vulnerability discoverers at http://www.cert.org/advisories/CA-2001-14.html

For related news see:
Oracle software flaws pose server attack threat
http://www.silicon.com/a45254
Which? hadn't even approved its own failed site
http://www.silicon.com/a45250
Microsoft patches the hole
http://www.silicon.com/a45153