RE: [Full-disclosure] Cisco IOS Shellcode Presentation

From: Madison, Marc (mmadison_at_fnni.com)
Date: 07/29/05

  • Next message: Tim: "Re: [Full-disclosure] Cisco IOS Shellcode Presentation" 
    Date: Fri, 29 Jul 2005 15:02:38 -0500
To: full-disclosure@lists.grok.org.uk

     Am I missing something here, because it seems that two vulnerabilities
    are being discussed, one is the IPv6 DOS
    http://www.cisco.com/warp/public/707/cisco-sa-20050729-ipv6.shtml. And
    the other is Lynn presentation on shellcode execution via the IOS?

    -----Original Message-----
    From: full-disclosure-bounces@lists.grok.org.uk
    [mailto:full-disclosure-bounces@lists.grok.org.uk] On Behalf Of Geo.
    Sent: Friday, July 29, 2005 2:57 PM
    To: full-disclosure@lists.grok.org.uk
    Subject: RE: [Full-disclosure] Cisco IOS Shellcode Presentation

    >>Read the advisory a bit closer. Here the relevant lines:
    "Products that are not running Cisco IOS are not affected.
    Products running any version of Cisco IOS that do not have IPv6
    configured interfaces are not vulnerable."

    Yes, IOS versions that have the fix, or that don't even run IPv6 are not
    *vulnerable*. But all IOS versions are *affected* by the *mechanism* he
    described. <<

    It's acutally a bit worse than that, IPv6 is enabled on all interfaces,
    you have to execute "no ipv6 enable" and "no ipv6 address" command on
    each interface to disable it.

    Second, the exploit is limited to local network segment, except it seems
    to me a worm that spreads from router to router could spread via the
    local network since a local network segment is usually defined as the
    wire between two routers.. Infection would spread from one router to
    it's peers, to those peers, etc. (please correct me if I'm wrong)

    Geo.

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Tim: "Re: [Full-disclosure] Cisco IOS Shellcode Presentation"

    Relevant Pages

    • RE: [Full-disclosure] Cisco IOS Shellcode Presentation
      ... Products running any version of Cisco IOS that do not have IPv6 ... It's acutally a bit worse than that, IPv6 is enabled on all interfaces, you ... me a worm that spreads from router to router could spread via the local ...
      (Full-Disclosure)
    • Re: [Full-disclosure] Cisco IOS Shellcode Presentation
      ... vulnerability and turn it into Something Useful. ... > Products running any version of Cisco IOS that do not have IPv6 ... > to me a worm that spreads from router to router could spread via the ...
      (Full-Disclosure)
    • [Full-disclosure] Cisco Security Advisory: Cisco IOS Information Leakage Using IPv6 Routing Head
      ... Cisco IOS Information Leakage Using IPv6 Routing Header ... Exploitation of this vulnerability can lead to information leakage on ...
      (Full-Disclosure)
    • Re: AAISP?
      ... Premium packages, and considering Max 1 Premium - depending on the ... nothing about IPv6, except that I'd end up with a /48 block if I ... I'd probably settle for setting up a PPPoE forward on my current router ... would I still be able to use the IPv4 ...
      (uk.telecom.broadband)
    • Re: strange problems with Internet connection
      ... So I did the same, set up a static IP, but left IPv6 ... Linksys router, or if I connect directly to the cable modem. ... my connection is slow and intermittent. ... I have had the same issues with IPv6 in both Ubuntu and Debian. ...
      (Ubuntu)