bugtraq - - Cisco IOS HTTP Server code injection/execution vulnerability-

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20051128163954.6624.qmail@securityfocus.com>
Date: 28 Nov 2005 16:39:54 -0000
From: picardos@...ra.es
To: bugtraq@...urityfocus.com
Subject: - Cisco IOS HTTP Server code injection/execution vulnerability-

It has been identified a vulnerability in the Cisco IOS Web Server. An attacker can inject
arbitrary code in some of the dynamically generated web pages. To succesfully exploit the vulnerability the attacker only needs to know the IP of the Cisco. THERE'S NO NEED TO HAVE ACCESS TO THE WEB SERVER! Once the code has been inyected, attacker must wait until the admin browses some of the affected web pages.

There is a URL in the IOS Web Server:

/level/15/exec/-/show/buffers

where administrators can view the content of memory buffers. There are many options, but we are
interested in:
"all" --> all buffers
and,
"assigned" --> Buffers in use

Following those links will show you those options:

"dump" --> Show buffer header and all data
"header" --> Show buffer headder only
"packet" --> Show buffer header and packet data

The "dump" and "packet" options are clearly affected by the code inyection. 

An attacker can buid a packet with HTML code in the payload field. When admin access some of the dump options in the show buffers page of the Cisco, the code is executed in his browser.

Full advisory and P.o.C. exploit that changes the "enable" password at:

http://www.infohacking.com