Re: Cisco IOS Shellcode Presentation

[Frank Knobbe <frank () knobbe us>]

On Fri, 2005-07-29 at 13:52 -0400, Micheal Espinola Jr wrote:
> Especially considering that the latest versions of the IOS are not
> vulnerable.

Read the advisory a bit closer. Here the relevant lines:
"Products that are not running Cisco IOS are not affected.
Products running any version of Cisco IOS that do not have IPv6
configured interfaces are not vulnerable."

Yes, IOS versions that have the fix, or that don't even run IPv6 are not
*vulnerable*. But all IOS versions are *affected* by the *mechanism* he
described. 

That means that the once thought-to-be-invulnerable boxes running IOS
are in fact as vulnerable as a Windows boxes. Once you get process
control, you can do whatever you like. (What is TCB anyway? Certainly
not Trusted Computing Base :)
All it takes is another vulnerability, another buffer/heap overflow, and
you can use the discussed mechanism to again make the router do your
bidding.

What he has done is not say "Here's a bug that I can exploit". He has
said "This IOS is capable of exploitation beyond current belief". And it
will be for the foreseeable future.

So if there is another bug report for an issue in IOS, don't think it
can be abused to spawn a reverse shell. He just told you to treat Cisco
vulnerabilities with the same respect as Windows vulnerabilities. When
you see another bug report, you might want to patch your routers a bit
faster.

Cheers,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/