In my opinion, probably the grossest error made by Cisco in all of
this was silently patching their IOS back in April. Anyone who's ever
used Cisco's software knows that you can never run the latest release,
unless you want things to break, and break badly. As a result, how
many organizations were at the latest, patched IOS release as of
BlackHat? Not many, I'd wager. If, however, Cisco had come clean and
told everyone that there is a serious problem in their IOS and
exploitation is being actively researched by Chinese hacker groups,
you'd see a lot more uptake of that April IOS release. Instead, Cisco
hangs their customers out to dry.
Shameful, just shameful.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Received on Aug 01 2005
Intro
