Cisco says FTP feature in IOS can provide hacker backdoor

Utility disabled by default, but vulnerability is real

Cisco says a flaw in the FTP server utility in its IOS router/switch software could be used as a backdoor by attackers.

IOS FTP, which comes disabled by default in IOS, is used to upload IOS software images and other software to routers and switches remotely. However, Cisco says attackers could exploit a vulnerability in the FTP server to gain access to the file system of an IOS-based router or switch and affect configuration settings.

"Unauthorized users could retrieve the device's startup-config file from the filesystem," Cisco says. "This file may contain information that could allow the attacker to gain escalated privileges."

Cisco is offering customers software fixes with the FTP server removed from IOS.

In the meantime, Cisco says users should shut down IOS FTP if they are running the server on an affected system. (The command to do this is "no ftp-server enable".) The company says users can upload software to IOS devices through other methods, such as the "Secure Copy" feature in the software. Users can also set up access control lists to restrict FTP access to a router or switch, Cisco adds.

Versions 11.3, 12.0, 12.1, 12.2, 12.3 and 12.4 of IOS are affected. Cisco's IOS XR is not vulnerable, and non-IOS Cisco devices are also safe. Cisco says it will remove the FTP feature in IOS because of this, and other past issues with the code. The company says it may add a secure FTP server to IOS in the future.

This story, "Cisco says FTP feature in IOS can provide hacker backdoor" was originally published by Network World.

Copyright © 2007 IDG Communications, Inc.

7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon