Cisco IOS fixes 10 denial-of-service vulnerabilities

September 27, 2013 10:12 AM ETIDG News Service - Cisco Systems has patched 10 vulnerabilities that could affect the availability of devices using various versions of its IOS software.

IOS is a multitasking operating system that combines networking and telecommunications functions and is used on many of the company's networking devices.

All of the patched vulnerabilities can affect a device's availability if exploited. They affect Cisco IOS implementations of the Network Time Protocol (NTP), the Internet Key Exchange protocol, the Dynamic Host Configuration Protocol (DHCP), the Resource Reservation Protocol (RSVP), the virtual fragmentation reassembly (VFR) feature for IP version 6 (IPv6), the Zone-Based Firewall (ZBFW) component, the T1/E1 driver queue and the Network Address Translation (NAT) function for DNS (Domain Name System) and PPTP (Point-to-Point Tunneling Protocol).

These vulnerabilities can be exploited by remote, unauthenticated attackers by sending specifically crafted packets over the network to IOS devices that have the affected features enabled.

Depending on the targeted vulnerability, attackers can cause the affected devices to hang, reload, lose connection, lose their ability to route connections or trigger other types of denial-of-service (DoS) conditions.

Workarounds for the NTP, ZBFW, T1/E1 driver queue and RSVP flaws are available and are described in the corresponding security advisories released by Cisco this week. To mitigate the other vulnerabilities, users will have to install patched versions of the IOS software, depending on which versions their devices already use.

"The effectiveness of any workaround or fix depends on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission," Cisco said. "Because of the variety of affected products and releases, customers should consult their service providers or support organizations to ensure that any applied workaround or fix is the most appropriate in the intended network before it is deployed."

The company is not aware of any malicious exploitation or detailed public disclosure of these vulnerabilities. They were discovered during internal security reviews or while troubleshooting customer service reports.

Reprinted with permission from IDG.net. Story copyright 2012 International Data Group. All rights reserved.

View the original article here

Cisco reveals its Internet of Everything router

Cisco Tuesday unveiled its Internet of Everything router, a device intended to address the growth in Internet traffic brought about by cloud, mobile, video and machine-to-machine communications.

The Network Convergence System (NCS), which was expected, is the culmination of three years of work by 450 engineers and $250 million in funding, Cisco says.

[ Also on InfoWorld: Teach your router new tricks with DD-WRT. | Get expert networking how-to advice from InfoWorld's Networking Deep Dive PDF special report and Technology: Networking newsletter. ]

NCS includes a new network processor Cisco introduced two weeks ago: the nPower X1.

The system is not a core router like the Cisco CRS, or a successor to the CRS, the company says. Rather, it is a network fabric designed to scale CRS cores and ASR 9000 edge routers in service provider networks from centralized systems to distributed architectures able to accommodate the growth of Internet connected "things," like cars, homes and machines.

[BUT DIDN'T THEY JUST ANNOUNCE...New Cisco core router boasts 10X capacity of original]

Cisco expects trillions of these device-driven events to come online in the next decade, a situation the company refers to as the Internet of Everything.

Cisco says it plans to equip the CRS systems with the nPower chip as well to improve scale and introduce programmability into the platform for core routing requirements.

Cisco says the NCS can transport the entire NetFlix library in less than one second in a full multi-chassis deployment. It converges IP and optical networks in the service provider realm with Cisco Unified Computing System (UCS) server and Dynamic Fabric Automation networking in the data center to serve as a "central nervous system" for a programmable infrastructure founded on the nPower chip and onePK APIs in Cisco operating systems.

This "central nervous system" is designed to shift and redirect data center, core, edge and optical resources in real-time to speed service rollouts and reduce operational cost and complexity, Cisco says. This is enhanced through virtualization capabilities in system software that elastically scale up and down network and compute resources, and manage multi-chassis configurations as a single system.  

If system scale is exceeded in one part of the network, NCS moves control plane functions onto UCS servers in the data center, Cisco says. NCS can also harness distributed Network Functions Virtualization (NFV) and other Cisco virtualization mechanisms to enable cross domain function orchestration and service placement where required, the company says.

Analysts say the fabric and programmability of NCS will turn up the competitive heat with Juniper's PTX and Alcatel-Lucent's 7950 XRS routers.

View the original article here

Super-fast Wi-Fi: Cisco, Ubiquiti access points top out at nearly 400Mbps

September 16, 2013 06:35 AM ETNetwork World - Earlier this year we tested several consumer-level 802.11ac routers. Here, we take a look at two enterprise-level access points. They're a part of the so-called "Wave 1" phase of the 802.11ac standard: both access points support up to three spatial streams and 80 MHz wide channels, offering theoretical data rates up to 1.3Gbps. But just as we saw with the 802.11ac routers, you won't get throughput rates nearly that fast.

Our test subjects were Cisco's Aironet 3602I AP with their 802.11ac module and Ubiquiti's UniFi AP AC. For the performance tests we used two clients: the Edimax AC1200 Wireless Dual-Band USB Adapter (two-stream 802.11ac) and the ASUS AC1750 Dual-band Wireless PCI-E Adapter (three-stream 802.11ac).

(Product review: Consumer-focused 802.11ac routers)

We found maximum throughput speeds in the range of 360M to 380Mbps range, similar to the rates found in the 802.11ac routers we tested earlier this year.

Cisco Aironet 3602I AP with 802.11ac Module

Cisco sent its Aironet 3602I Access Point ($1,495) loaded with their 802.11ac module ($500). Although the access point supports the standard Control and Provisioning of Wireless Access Points Protocol (CAPWAP), we used their Cisco 2504 Wireless LAN Controller for the testing.

The access point comes with two integrated 2.4GHz/5GHz dual-band radios. The 802.11ac module that attaches to the bottom of the access point adds a 5-GHz radio supporting three spatial streams. The access point supports broadcasting up to 16 SSIDs. There's a 2dBi gain internal omnidirectional antenna for 2.4 GHz and 5 dBi gain internal omnidirectional antennas for 5Ghz. The maximum transmit power for both integrated dual-band radios is 23 dBm and 22 dBm for the 802.11ac module.

The access point has a similar form factor as the Ubiquiti AP: a rounded-square panel, but is about an inch larger in height and length. Its depth is about double of the Ubiquiti AP. And with the 802.11ac module installed the access point is about 3.5 pounds; more than triple the weight of the Ubiquiti AP. On the front of the access point is a LED light to indicate the access point status. On the back you'll find the Mode button, a Gigabit Ethernet port, and a console Ethernet port. Plus there's a DC power jack, which is required to power the 802.11ac module if using 802.3af PoE instead of 802.3at PoE+.

The access point setup and configuration process was fairly straightforward, but could be complex for those without Cisco experience. The web-based interface of the controller is akin to other Cisco products. All the controller and access point settings are highly configurable and customizable. The Cisco AP performed anywhere from 4% to 22% better on our throughput tests than the Ubiquiti AP.

Reprinted with permission from NetworkWorld.com. Story copyright 2012 Network World, Inc. All rights reserved.

View the original article here