Date: Wed, 10 Oct 2007 12:35:45 -0400
From: Omar Santos <osantos@...co.com>
To: Andy Davis <andy.davis@...plc.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Cisco IOS LPD Remote Stack Overflow

Hello,

Cisco greatly appreciates the opportunity to work with researchers on
security vulnerabilities, and welcome the opportunity to review and
assist in product reports. We have posted a vendor security response at:

http://www.cisco.com/warp/public/707/cisco-sr-20071010-lpd.shtml

The text of which is also included below.
--
Omar Santos
Cisco PSIRT


------
Cisco Security Response: Cisco IOS Line Printer Daemon (LPD) Protocol
Stack Overflow

Document ID: 99109

http://www.cisco.com/warp/public/707/cisco-sr-20071010-lpd.shtml

Revision 1.0

For Public Release 2007 October 10 1600 UTC (GMT)

---------------------------------------------------------------------

Cisco Response
==============

This is the Cisco Product Security Incident Response Team (PSIRT)
response to an issue discovered and reported to Cisco by Andy Davis
from IRM, Plc. regarding a stack overflow in the Cisco IOS Line
Printer Daemon (LPD) Protocol feature. The original post is available
at the following link:

http://www.irmplc.com/index.php/155-Advisory-024

Cisco greatly appreciates the opportunity to work with researchers on
security vulnerabilities, and welcome the opportunity to review and
assist in product reports.

Additional Information
======================

Cisco has confirmed the security research's findings and has
documented this issue in Cisco Bug ID CSCsj86725.

All versions of IOS that support the LPD functionality except the
ones listed below are affected. Customers that do not enable the LPD
functionality are not affected.

Note: LPD is disabled by default on Cisco IOS routers.

If LPD services are configured, then one or more global printer
<name> command lines would be present in the router's configuration.

No other Cisco products are currently known to be affected by this
vulnerability.

This issue has been fixed on versions 12.2(18)SXF11, 12.4(16a),
12.4(2)T6 and later. For more information please view the bug's
details via the Bug Toolkit on Cisco.com.

Workaround
==========

If LPD services are not required, they can be disabled by using the 
no printer command; thus, eliminating this vulnerability.

Note: LPD is disabled by default on Cisco IOS routers.

In addition, LPD uses TCP port 515. An access control list (ACL) can
be configured to only allow trusted devices to communicate to the
router via TCP port 515.

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.

Revision History
================

+---------------------------------------+
| Revision |                 | Initial  |
| 1.0      | 2007-October-10 | public   |
|          |                 | release. |
+---------------------------------------+

Cisco Security Procedures
=========================

Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html.
This includes instructions for press inquiries regarding Cisco
security notices.  All Cisco security advisories are available at
http://www.cisco.com/go/psirt.




On Wed, 2007-10-10 at 16:53 +0100, Andy Davis wrote:
> ----------------------------------------------------------------------
> IRM Security Advisory 024
> 
> Cisco IOS LPD Remote Stack Overflow
>  
> Vulnerability Type / Importance: Remote Code Execution / High
> 
> Problem Discovered: 30 July 2007
> Vendor Contacted: 30 July 2007
> Advisory Published: 10 October 2007
> ----------------------------------------------------------------------
> 
> Abstract:
> 
> The LPD daemon included in Cisco IOS is vulnerable to a remote stack
> overflow
> 
> Description:
> 
> The Line Printer Daemon, which provides print server functionality in
> Cisco IOS is vulnerable to a software flaw whereby the length of the
> hostname of the router is not checked before being copied into a fixed
> size memory buffer. This results in IOS crashing if the hostname is too
> long, but could potentially result is arbitrary code execution. However,
> the attacker must be able to control the hostname of the router, which
> could be achieved via SNMP.   
> 
> Technical Details:
> 
> When the LPD daemon is configured in Cisco IOS it listens on the default
> LPD TCP port, 515. If connected to with a source TCP port of anything
> other than 515 the following error is displayed:
> 
> $ telnet 172.30.3.101 515
> Trying 172.30.3.101...
> Connected to 172.30.3.101 (172.30.3.101).
> Escape character is '^]'.
> hostname_of_the_router: /usr/lib/lpd: Malformed from address
> 
> If the hostname is 99 characters or longer then the overflow occurs as
> the result of a call to the sprintf() function. Although this is
> technically a stack overflow, because IOS allocates heap memory for
> process stacks, the memory overwritten is actually heap. However, as the
> heap memory is acting as a stack, the return address, stored before the
> start of the character buffer, can be overwritten by the hostname when
> the overflow occurs, but for some reason the crash doesn't occur until
> the buffer intrudes into the "red zone" at the boundary of the heap
> chunk. Therefore, when the crash happens and the router reboots, the
> memory dump indicates heap corruption.
> 
> It must be reiterated that control of the hostname is required to
> exploit this vulnerability. If SNMP is running on the device and the
> "read/write" community string is known (this is often set to the default
> value "private") then the hostname can be set as follows:
> 
> $ snmpset -Os -c private -v 1 10.0.0.1 system.sysName.0 s long_hostname
> 
> Vendor & Patch Information:
> 
> Cisco has released an update to resolve this issue; this can be
> downloaded from:
> 
> http://www.cisco.com/warp/public/707/cisco-sr-20071017-lpd.shtml
>  
> Workaround:
> 
> Cisco has provided the following workaround to mitigate this
> vulnerability:
> 
> http://www.cisco.com/warp/public/707/cisco-sr-20071017-lpd.shtml
> 
> Tested/Affected Versions:
> 
> IRM identified this vulnerability in IOS version 12.3(22)
> 
> Credits:
> 
> Research & Advisory: Andy Davis
> 
> Disclaimer:
> 
> All information in this advisory is provided on an 'as is' basis in the
> hope that it will be useful. Information Risk Management Plc is not
> responsible for any risks or occurrences caused by the application of
> this information.
> 
> www.irmplc.com
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
-- 
---------------------------
Omar Santos
Incident Manager
Cisco - PSIRT
Email: osantos@...co.com
Phone: 919.392.8635
www.cisco.com/security
www.cisco.com/go/psirt
---------------------------

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists