IDS mailing list archives
Re: Signature for CVE ID: CVE-2008-1151 (CISCO PPTP memory leak - DoS)
From: "Secure Scorp" <securescorp () gmail com>
Date: Sat, 5 Jul 2008 13:19:31 +0530
This vulnerablity as described by Cisco occurs when the PPTP session is terminated. Please note it states 'terminated'. If terminates means log off then it means that a legitimate active connective has logged off etc. For this vulnerablity to be exploited the user should be a legitimate user.I think it is difficult to write a signature for such legitimate users.Even if we write any signatures, we are bound to get false positives as you correctly mentioned. There is no possible work around in the Cisco configuration as well. I don't think so that anyone can carry out DoS to exploit this vulnerablity.If we still want to write some signatures then we should write it for TCP 1723 and GRE (protocol 47) with higher rate OR only on TCP 1723 as it is the connection channel. Cisco has released a software to address this issue. The best and fastest way to go about this vulnerablity is to patch the router than spending resources on writing signatures which are bound to give false positives. Note: PPTP initiates/terminates the connections on TCP 1723 and the data is sent using/encapsulating GRE (protocol 47). Thanks, Aditya Govind Mukadam On Fri, Jul 4, 2008 at 9:33 PM, Ravi Chunduru <ravi.is.chunduru () gmail com> wrote:
Please see these links for more information on vulnerability: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1151 http://www.cisco.com/en/US/products/products_security_advisory09186a0080969862.shtml According to this vulnerability report, PPTP process in CISCO routers leak memory upon every PPTP termination. Eventually memory is used up and no other PPTP connections are entertained. How does one go about writing signatures for detecting exploits targeting this vulnerability? Only possibility I can think of, based on capabilities of signature language, is to check for the rate at which these PPTP connections are made. If it checks for higher rate, there could be false negatives where attacker makes the connections at very slow rate. If it checks for lower rate, then there is possibility of false positives. What is the right way of writing signatures? thanks Ravi ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
Current thread:
- Signature for CVE ID: CVE-2008-1151 (CISCO PPTP memory leak - DoS) Ravi Chunduru (Jul 04)
- Re: Signature for CVE ID: CVE-2008-1151 (CISCO PPTP memory leak - DoS) Secure Scorp (Jul 07)
- Re: Signature for CVE ID: CVE-2008-1151 (CISCO PPTP memory leak - DoS) Srinivasa Addepalli (Jul 07)
- Re: Signature for CVE ID: CVE-2008-1151 (CISCO PPTP memory leak - DoS) Secure Scorp (Jul 09)
- RE: Signature for CVE ID: CVE-2008-1151 (CISCO PPTP memory leak - DoS) Srinivasa Addepalli (Jul 14)
- Re: Signature for CVE ID: CVE-2008-1151 (CISCO PPTP memory leak - DoS) Secure Scorp (Jul 09)