Update: ISS researcher agrees to silence on Cisco flaws

IDG News Service - A security researcher who gave a presentation on vulnerabilities in Cisco Systems Inc. routers at this week's Black Hat USA conference has agreed not to further discuss the issue under the terms of a permanent injunction issued by a U.S. court.

Cisco plans to issue a security advisory "within the next day," according to a statement the company released after the injunction was issued.

Cisco and Internet Security Systems Inc. (ISS) sought the injunction against Michael Lynn, who gave the Wednesday morning presentation, and Black Hat Inc., which organized the Las Vegas computer security conference. It was granted Thursday by Judge Jeffrey White of the U.S. District Court for the Northern District of California in San Francisco.

All parties involved in the case have agreed to the injunction, effectively putting an end to a dispute that dominated the final two days of Black Hat and diminished the reputation of Cisco and ISS in the eyes of many attendees.

ISS had originally replaced the presentation, titled "The Holy Grail: Cisco IOS Shellcode and Remote Execution," with a different one and had ensured that the presentation materials were torn out of a book that was part of the materials given out at the Black Hat show.

But Lynn, a research analyst at ISS, quit his job at ISS and gave the presentation anyway. Cisco and ISS had agreed that more research was needed, said Cisco spokesman John Noh, adding that the presentation did not reveal any new vulnerabilities or flaws.

Cisco took a dim view of Lynn's presentation, however. "The information that Mr. Lynn disclosed at the conference, we believe was illegally obtained and included Cisco intellectual property," Noh said.

Lynn described a now-patched flaw in the Internetwork Operating System (IOS) software used to power Cisco's routers and demonstrated a buffer-overflow attack in which he took control of a router. Although Cisco had been informed of the flaw by ISS and had patched its firmware in April, users running older versions of the company's software are at risk, he said.

Among other things, the injunction blocks Lynn from disclosing or disseminating any part of the presentation, disseminating any video recording of the presentation or disassembling or reverse-engineering Cisco code in the future.

Cisco said it sought the injunction "to stop continued irresponsible public disclosure of illegally obtained proprietary information."

At a news conference Thursday afternoon, Lynn admitted that he had converted some of Cisco's binary code into a human-readable form, a process called reverse engineering. But he disputed the idea that this