Re: [Full-disclosure] Cisco IOS Shellcode Presentation

From: Frank Knobbe (frank_at_knobbe.us)
Date: 07/29/05

  • Next message: Jason Coombs: "Re: [Full-disclosure] Cisco IOS Shellcode Presentation" 
    To: Micheal Espinola Jr <michealespinola@gmail.com>
Date: Fri, 29 Jul 2005 13:14:58 -0500

    On Fri, 2005-07-29 at 13:52 -0400, Micheal Espinola Jr wrote:
    > Especially considering that the latest versions of the IOS are not
    > vulnerable.

    Read the advisory a bit closer. Here the relevant lines:
    "Products that are not running Cisco IOS are not affected.
    Products running any version of Cisco IOS that do not have IPv6
    configured interfaces are not vulnerable."

    Yes, IOS versions that have the fix, or that don't even run IPv6 are not
    *vulnerable*. But all IOS versions are *affected* by the *mechanism* he
    described.

    That means that the once thought-to-be-invulnerable boxes running IOS
    are in fact as vulnerable as a Windows boxes. Once you get process
    control, you can do whatever you like. (What is TCB anyway? Certainly
    not Trusted Computing Base :)
    All it takes is another vulnerability, another buffer/heap overflow, and
    you can use the discussed mechanism to again make the router do your
    bidding.

    What he has done is not say "Here's a bug that I can exploit". He has
    said "This IOS is capable of exploitation beyond current belief". And it
    will be for the foreseeable future.

    So if there is another bug report for an issue in IOS, don't think it
    can be abused to spawn a reverse shell. He just told you to treat Cisco
    vulnerabilities with the same respect as Windows vulnerabilities. When
    you see another bug report, you might want to patch your routers a bit
    faster.

    Cheers,
    Frank

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Jason Coombs: "Re: [Full-disclosure] Cisco IOS Shellcode Presentation"

    Relevant Pages