RE: multiple looking-glasses input vulnerability

From: arivanov@sigsegv.cx
Date: 10/19/01 

Message-ID: <XFMail.20011019075332.arivanov@sigsegv.cx>
Date: Fri, 19 Oct 2001 07:53:32 +0100 (BST)
From: arivanov@sigsegv.cx
To: barabas@lokmail.net
Subject: RE: multiple looking-glasses input vulnerability

Hi list,
        I answered the original post but the submission did not go through.
        In brief: the original David Kern looking glass has a number of
problems. These are inherited in most code derived from it:
        1. The only security measure used in the code is a http-referer check
which is a parameter suppplied by the user and can be changed at will.
        2. The parameters supplied to a rsh executed on the local machine are
not checked. It is executed via fork/exec, not a perl pipe open so shell
expansions cannot be used, but it still leaves possibilities for supplying rsh
with bogus arguments
        3. The parameters suppplied to the router are not checked properly. The
only check in the original looking glass is a check for NULL param so that the
router does not try to do a full BGP dump. This check is bogus as well because
one can supply an argument of a regular expression to the sh ip bgp. This
argument can resolve to the full BGP table and cause arbitrary additional
router load. So any router accessible via non-fixed lg can be effectiviely
DOSed up to full CPU load.

        The solution to this unfortunately is full rewrite from scratch using
CGI.pm, perl's Net::telnet instead of rsh/fork/exec and proper parameter
checking/mangling.
        I have done this in the past so at least a few LGs I know of are not
vulnerable ;-)

On 18-Oct-2001 barabas@lokmail.net wrote:
> Hi,
>
> There is a flaw in many looking-glasses (most of them based on the
> nitrous-digex one ) which allows attackers to gather information about
> the network which is not intentionally provided through looking-glass
> functionality:
>
> It seems that the looking-glass (which is usually written in Perl)
> doesn't check the input properly for the validity of the input address.
>
>
> example:
>
> when clicking bgp, to check an address in the bgp table, the attacker
> can enter , instead of an ip address, the word "nei"(or neighbours)
> and all bgp neighbours will be fully visible. In fact, any valid argument
> in cisco IOS following sh ip bgp, can be entered.
> Another example: <sh ip bgp> paths gives the full path table. This
> puts some strain on routers and could be used to DOS the router if
> no proper access security is provided.
> Various other things can be done
>
> workaround: check for a "." in the input . This shouldn't be too hard
> to implement in the script :-)
>
> Haven't checked for traversal possibilities yet ;-)
>
>
> Barabas
>
>
>
>
>
>
> ---------------------------------------------------------
> Get Free Private Encrypted Email https://mail.lokmail.net
> Switch to Name.Space: http://namespace.org/switch

----------------------------------
Anton R. Ivanov
ARI2-RIPE
Today's deliverables will have to be delayed because:

Your parity check is overdrawn and you're out of cache.

----------------------------------
End of MIME message

Relevant Pages

  • Re: Load-balancing across four T1s on 2 routers
    ... router will receive 2/3 of the traffic and the other will receiving 1/3 ... EIGRP supports UNequal-cost load-balancing in that manner, ... In you case BGP scenario will be really easy. ... switch will then see 2 UN-equal cost default routes in its routing ...
    (comp.dcom.sys.cisco)
  • Re: BGP "no synchronization"
    ... I do not understand "bgp synchronisation". ... router with IBGP fully meshed across the three. ... learned via EIGRP before an IBGP router should install the route ...
    (comp.dcom.sys.cisco)
  • Re: Load-balancing across four T1s on 2 routers
    ... UNequal-cost load-balancing? ... router will receive 2/3 of the traffic and the other will receiving 1/3 ... just add couple more command to your BGP config ... EIGRP between you and ISP? ...
    (comp.dcom.sys.cisco)
  • Re: Does Cisco 1760 Series Router Support Multiple Gateways?
    ... not as a failover type configuration. ... the router, which would allow you to manage 2 internet connections. ... You'd need your own BGP AS, public IP addresses, and a maxed out 1760 ...
    (comp.dcom.sys.cisco)
  • multiple looking-glasses input vulnerability
    ... There is a flaw in many looking-glasses (most of them based on the ... nitrous-digex one) which allows attackers to gather information about ... when clicking bgp, to check an address in the bgp table, the attacker ... puts some strain on routers and could be used to DOS the router if ...
    (Bugtraq)