Cisco warns of router flaw

Cisco 12000 series could suffer from denial of service attack

Cisco has warned that a series of vulnerabilities in one of its routers could cause it to crash. The flaw in the Cisco 12000 series could allow hackers to cause a denial of service (DoS) attack, the company said.

A router can slow down or stop altogether when it has to send a large number of Internet Control Message Protocol (ICMP) Unreachable packets.

Cisco is urging any customers experiencing problems to ask their channel partners for a software upgrade.

"Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organisations such as Cisco partners, authorised resellers or service providers should contact them for upgrade assistance," the company said in a statement.

The problem occurs during heavy network scanning by a hacker. Only line cards in the router based on Cisco's Engine technology are thought to be affected.

The vulnerability happens when a packet is dropped, either when there is no valid path to the destination or when the packet should be routed to the Null0 interface.

Whenever a packet is dropped the router must send an ICMP Unreachable packet back to the source. If enough messages are sent which need ICMP Unreachable replies, processing the replies can saturate the processor.

This can happen when the router is either 'Black Hole' filtering, dropping packets sent to it as the networks default path, or from a direct DoS attack against the router.

Another vulnerability happens when fragmented traffic is sent through an Engine 2-based line card. Traffic sent in fragmented form will get round Access Control List on the router and cause a DoS attack.

"When examined more closely, you usually find there are narrowly defined parameters in which these problems could become risks," said Paul Cunningham, marketing director at Cisco distributor Comstor. "It is always a concern when these things come up, but Cisco has a good track record in getting things fixed."