full-disclosure - Cisco IOS Shellcode Presentation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1122660898.32564.54.camel@localhost>
Date: Fri Jul 29 19:15:11 2005
From: frank at knobbe.us (Frank Knobbe)
Subject: Cisco IOS Shellcode Presentation

On Fri, 2005-07-29 at 13:52 -0400, Micheal Espinola Jr wrote:
> Especially considering that the latest versions of the IOS are not
> vulnerable.

Read the advisory a bit closer. Here the relevant lines:
"Products that are not running Cisco IOS are not affected.
Products running any version of Cisco IOS that do not have IPv6
configured interfaces are not vulnerable."

Yes, IOS versions that have the fix, or that don't even run IPv6 are not
*vulnerable*. But all IOS versions are *affected* by the *mechanism* he
described. 

That means that the once thought-to-be-invulnerable boxes running IOS
are in fact as vulnerable as a Windows boxes. Once you get process
control, you can do whatever you like. (What is TCB anyway? Certainly
not Trusted Computing Base :)
All it takes is another vulnerability, another buffer/heap overflow, and
you can use the discussed mechanism to again make the router do your
bidding.

What he has done is not say "Here's a bug that I can exploit". He has
said "This IOS is capable of exploitation beyond current belief". And it
will be for the foreseeable future.

So if there is another bug report for an issue in IOS, don't think it
can be abused to spawn a reverse shell. He just told you to treat Cisco
vulnerabilities with the same respect as Windows vulnerabilities. When
you see another bug report, you might want to patch your routers a bit
faster.

Cheers,
Frank

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050729/9bea060c/attachment.bin