RE: [Full-disclosure] Cisco IOS Shellcode Presentation

From: Geo. (geoincidents_at_nls.net)
Date: 07/29/05

  • Next message: Andrew R. Reiter: "Re: [Full-disclosure] Cisco IOS Shellcode Presentation" 
    To: <full-disclosure@lists.grok.org.uk>
Date: Fri, 29 Jul 2005 15:56:38 -0400

    >>Read the advisory a bit closer. Here the relevant lines:
    "Products that are not running Cisco IOS are not affected.
    Products running any version of Cisco IOS that do not have IPv6
    configured interfaces are not vulnerable."

    Yes, IOS versions that have the fix, or that don't even run IPv6 are not
    *vulnerable*. But all IOS versions are *affected* by the *mechanism* he
    described. <<

    It's acutally a bit worse than that, IPv6 is enabled on all interfaces, you
    have to execute "no ipv6 enable" and "no ipv6 address" command on each
    interface to disable it.

    Second, the exploit is limited to local network segment, except it seems to
    me a worm that spreads from router to router could spread via the local
    network since a local network segment is usually defined as the wire between
    two routers.. Infection would spread from one router to it's peers, to those
    peers, etc. (please correct me if I'm wrong)

    Geo.

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Andrew R. Reiter: "Re: [Full-disclosure] Cisco IOS Shellcode Presentation"

    Relevant Pages