SAN JOSE, Calif. (AP) – The maker of the equipment that relays much of the Internet’s traffic has announced a serious software flaw, sending companies that operate key backbones of the global network scrambling to patch it.
Hackers could use the vulnerability in Cisco Systems routers and other switches to cause widespread Internet outages, network managers said. Cisco notified some major Internet carriers of the flaw Tuesday and publicly announced it late Wednesday.
So far, the problem has not been exploited, according to Cisco, which released a free patch to fix the flaw in its widely used Internetworking Operating System.
“Cisco is not aware of any active exploitation of the vulnerability and is working closely with its customers as well as industry, the government, academia and Internet security organizations to effectively address this issue,” Cisco spokesman Jim Brady said.
According to Cisco’s alert, the vulnerability could be exploited by sending a “rare sequence” of data packets to a device running IOS, the equivalent of Windows for routers and switches. It causes the device to stop processing traffic once its incoming queue is full.
An attack would not trigger any alarms and could be repeated until the device is inaccessible. Brady said Cisco discovered the vulnerability through internal testing.
“This type of attack can be launched at a specific target, or launched indiscriminately to cause widespread outages,” according to an alert issued by Internet Security Systems.
Internet carriers and providers have scheduled an unusually high number of emergency maintenance outages since Wednesday – probably because routers are being rebooted with new software, said Dan Ingevaldson, engineering manager for ISS’s X-Force research development group.
On Wednesday, Microsoft Corp. acknowledged a critical vulnerability in nearly all versions of its Windows operating system. Microsoft, which also released a free patch, said the problem could allow hackers to seize control of Windows computers over the Internet.
Comments are no longer available on this story