1/29/2007 -- Cisco Systems Inc. last week confirmed the existence of three vulnerabilities in its IOS operating system -- the two most serious of which could allow an attacker to execute arbitrary code on compromised devices.

First, a flaw in Cisco's IOS TCP listener makes all IOS-based routers and switches vulnerable to denial-of-service (DoS) attack.

An attacker can exploit this vulnerability by crafting malicious packets that -- when sent to physical or virtual interfaces on IOS-based devices -- trigger memory leaks and ultimately cause DoS. There are a couple of caveats, however: The vulnerability only applies to traffic that's actually destined for IOS devices, Cisco said; traffic that's merely transiting an IOS device won't trigger the vulnerability. The vulnerability also doesn't affect IOS-XR, Cisco said.

More serious is a crafted IP option flaw which renders all IOS- and IOS XR-based routers and switches vulnerable to another kind of DoS attack.

In this case, an attacker who crafts a packet with a specific IP option in its IP header can trigger DoS and -- in some cases -- execute arbitrary code on compromised systems. Likewise, Cisco warned of an IPv6 routing header vulnerability that can also trigger DoS. An attacker can exploit the vulnerability by crafting malicious IPv6 Type 0 Routing headers and sending them to any IPv6 address that's defined on a vulnerable device.

Add it all up, analysts say, and you've got the makings of a DoS perfect storm. "[T]he vulnerabilities ... could affect a broad range of Cisco products," write Gartner analysts Rich Mogull and Mark Nicolett. "The problem is made even more severe by the frequent use of IOS devices to provide security services, such as packet filtering and access control lists."

Gartner's Rx probably isn't music to Cisco CEO John Chambers' ears, however: The best protection against wide-ranging vulnerabilities of this kind is heterogeneity, Mogull and Nicolett argue. "These IOS vulnerabilities show that a separate security control layer is often required outside the network management layer, because network heterogeneity reduces the likelihood that a single vulnerability could compromise both network security and network infrastructure." --Stephen Swoyer