Full Disclosure mailing list archives
FW: Cisco Bug 44020
From: "Noren, Bill" <Bill.Noren () PaeTec com>
Date: Tue, 22 Jul 2003 15:40:58 -0400
Hey folks, It turns out that the tar file Shanphen mentions below is empty. I found it at: http://www.k-otik.com/exploits/07.21.cisco-bug-44020.c.php with a link to working .gz as well. It looks like a cleanup of the original exploit but still relying completely on exploiting via protocols 53, 55, 77 and 103. FWIW, I grabbed a copy of shadowchode.c and ran it against a lab 2611 running 12.1(16) and it locks the interface quite nicely after 38 iterations of the code (one half of 76 ;-). This takes about 0.4 seconds to complete. I was also serially connected at the time and although IP traffic was blocked I could easily work within the router and save to NVRAM and issue a reload command. Good news for those of you still vulnerable with terminal access to your equipment. After re-booting, (lol!) I applied an ACL to block those protocols on the incoming interface from my laptop and the exploit no longer worked against that interface or one on the other side of the router. For giggles I decided to recompile the code for protocols 54, 56, 78 and 104 and tried all over again and was not successful. I don't remember seeing in any of the threads if the protocols were specific but from my ever-so-random test it appears they are. Granted, I may have overlooked that part somewhere and I'm still reviewing all of this, especially for new exploits that may be uncovered because of all of this. Cheers, -Bill -----Original Message----- From: Shanphen Dawa [mailto:list () hardlined com] Sent: Tuesday, July 22, 2003 1:45 PM To: full-disclosure () lists netsys com Subject: [Full-disclosure] Cisco Bug 44020 Here is supposedly a working Cisco exploit: http://www.elxsi.de/cisco-bug-44020.tar.gz This is pasted from security focus: http://www.securityfocus.com/archive/1/329765/2003-07-19/2003-07-25/0 To: BugTraq Subject: Cisco IOS exploit (44020) Date: Jul 21 2003 4:01PM Author: Martin Kluge <martin elxsi de> Message-ID: <20030721160132.GA61689 () elxsi de> .. snip .. _____________________________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Cisco Bug 44020 Shanphen Dawa (Jul 22)
- <Possible follow-ups>
- FW: Cisco Bug 44020 Noren, Bill (Jul 22)
- Re: FW: Cisco Bug 44020 bill.noren (Jul 22)
- Re: FW: Cisco Bug 44020 hicks (Jul 23)