What can we learn from the Cisco fiasco?

In late July, Cisco and ISS made headlines when the companies took unprecedented steps to stop a former ISS employee from disclosing Internet security vulnerabilities in Cisco's Internetwork Operating System (IOS) at the 2005 Black Hat security conference in Las Vegas. The companies took Michael Lynn to court, seeking a temporary restraining order from a US District Court and eventually agreeing on a permanent injunction that prohibits any further discussion of the presentation or dissemination of any information or recordings.

By now, you're likely to be more than a little familiar with this case. A high-profile story in the media, the controversy spurred all sorts of discussions about the legal debacle, the players involved, and the long-term ramifications. While such discussions are both interesting and relevant, that doesn't mean we can neglect the implications for the security arena.

Why was Cisco willing to take these extraordinary steps to prevent public disclosure? Let's take a closer look at the vulnerability, the issue, and a possible resolution.

The flaw
The flaw that Lynn resigned his job in order to disclose the information in his Black Hat presentation certainly wasn't new. It's rooted in an advisory that Cisco first published in April 2004, "Cisco Security Advisory: TCP Vulnerabilities in Multiple IOS-Based Cisco Products."

In his presentation, the former ISS researcher outlined a method for taking control of an IOS-based router, using this buffer overflow or a heap overflow attack. In fact, this flaw has been well-documented. In addition, depending on the version of IOS running on the router, the fixed version of the IOS was available, or Cisco made one available shortly after.

The problem
While the Cisco vulnerability was only one of several scheduled topics up for discussion at the Black Hat conference, the flaw — and the surrounding controversy — received the lion's share of attention. The disclosure of a new use for an old flaw became a hot topic, and almost everyone seems to have an opinion.

It's important to realise that not every business that runs Cisco routers reads...

For more, click here...