 
  See your link here
|
For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Update: ISS researcher agrees to silence on Cisco flaws
or
Other Spam, Malware and Vulnerabilities Stories
|
|
|
|
July 28, 2005 (IDG News Service) --
A security researcher who gave a presentation on vulnerabilities in Cisco Systems Inc. routers at this week's Black Hat USA conference has agreed not to further discuss the issue under the terms of a permanent injunction issued by a U.S. court.
Cisco plans to issue a security advisory "within the next day," according to a statement the company released after the injunction was issued.
Cisco and Internet Security Systems Inc. (ISS) sought the injunction against Michael Lynn, who gave the Wednesday morning presentation, and Black Hat Inc., which organized the Las Vegas computer security conference. It was granted Thursday by Judge Jeffrey White of the U.S. District Court for the Northern District of California in San Francisco.
All parties involved in the case have agreed to the injunction, effectively putting an end to a dispute that dominated the final two days of Black Hat and diminished the reputation of Cisco and ISS in the eyes of many attendees.
ISS had originally replaced the presentation, titled "The Holy Grail: Cisco IOS Shellcode and Remote Execution," with a different one and had ensured that the presentation materials were torn out of a book that was part of the materials given out at the Black Hat show.
But Lynn, a research analyst at ISS, quit his job at ISS and gave the presentation anyway. Cisco and ISS had agreed that more research was needed, said Cisco spokesman John Noh, adding that the presentation did not reveal any new vulnerabilities or flaws.
Cisco took a dim view of Lynn's presentation, however. "The information that Mr. Lynn disclosed at the conference, we believe was illegally obtained and included Cisco intellectual property," Noh said.
Lynn described a now-patched flaw in the Internetwork Operating System (IOS) software used to power Cisco's routers and demonstrated a buffer-overflow attack in which he took control of a router. Although Cisco had been informed of the flaw by ISS and had patched its firmware in April, users running older versions of the company's software are at risk, he said.
Among other things, the injunction blocks Lynn from disclosing or disseminating any part of the presentation, disseminating any video recording of the presentation or disassembling or reverse-engineering Cisco code in the future.
Cisco said it sought the injunction "to stop continued irresponsible public disclosure of illegally obtained proprietary information."
At a news conference Thursday afternoon, Lynn admitted that he had converted some of Cisco's binary code into a human-readable form, a process called reverse engineering. But he disputed the idea that this was an illegal practice. "It's, generally speaking, not illegal to reverse-engineer for security reasons," he said.
Many end-user license agreements,
Reprinted with permission from
IDG.netStory copyright 2008 International Data Group. All rights reserved.
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
 |
| All Zones Application Performance Zone Business Continuity Zone The File Data Management Zone Security Management Zone The SAS Zone Business Intelligence and Analytics Zone Windows Protection Zone The Enterprise Search Zone Software as a Service Zone The Security Zone |
|
See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
From Laggard to Leader: Transforming the Data Center
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs. 
Download this white paper today!
Read up on the latest ideas and technologies from companies that sell hardware, software and services. 
- Feds considering changes to H-1B application process in wake of report
- The Grill: Privacy is a thing of the past, says private investigator
- Exploit code loose for six-month-old Windows bug
- More top stories
 The Security Zone
Securing your network begins at the gateway, also called the perimeter, to keep unauthorized users, viruses and malicious code from entering your systems. Deploying multilayer technologies is your first line of defense. With the mobility of employees and the ease with which external devices can be brought in and out of a network, continuing to build your security plan for network servers and clients is a must. Fortunately, there is much that organizations can do to protect themselves from attacks - internal and external. One of the key facets of a successful security strategy is protecting the servers that run critical applications and house so much of your essential data. Having the right policies, procedures and server configurations is critical. Learn more in The Security Zone See All Zones
|
 Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.New baits 
|
|
|
Preston Gralla: Apple plays the bully again
Apple is once again unleashing its attack dog lawyers. This time against a college for using an apple in its logo. ... [more]
|
