full-disclosure - Cisco IOS Shellcode Presentation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200507300020.j6U0KAnY010411@turing-police.cc.vt.edu>
Date: Sat Jul 30 01:21:09 2005
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Cisco IOS Shellcode Presentation 

On Fri, 29 Jul 2005 18:57:15 CDT, "J.A. Terranson" said:

> This has nothing to do with the choice of "a general purpose CPU", it is a
> result of a specific architecture within the CPU chosen.  There is a real
> difference here.

Actually, although I've flamed Jason quite a bit, he *is* right in that the use
of *any* general purpose processor implies these sorts of vulnerabilities. The
*exact* results depend on things like the ABI they chose to use.  However,
saying "If they had used a different stack layout or different procedure call
conventions, none of this would have happened" is disingenuous. If you have an
ABI on anything we'd consider a "general purpose CPU", you have these same
*classes* of vulnerabilities.  The only way you can get rid of them is either to
not use a CPU at all (the FPGA/ASIC solution), or go with some exotic
architecture like Intel's  iAXP432(*) or the IBM S/38, which are both "tagged"
architectures, but hardly qualify as "general purpose".

Given the other choices, I can hardly say Cisco is guilty of *negligence*.
(On the other hand, if they used the word 'Unbreakable' to describe their
product, false advertising may be an issue.. ;)

(*) OK, so the 432 wasn't *really* able to provide much more than a hardware
implementation of Pascal-style type checking - the hidden 'gotcha' is that
it's fiendishly difficult to do operating system level coding on any sort
of B&D processor, because you can't typecast easily - and things like IOS
are almost entirely operating system level stuff...  In addition, you get
the performance penalties of hardware type checking....)

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050729/b6956b5d/attachment.bin