Slashdot Mirror
Major Flaw Found In Cisco IOS Devices
Joff_NZ writes "CERT has released an advisory regarding a serious flaw in all Cisco routers and switches which run IOS and process IPv4 packets (i.e. pretty much everything), which causes the device to stop processing inbound packets, and so: 'The device must be rebooted to clear the input queue on the interface, and will not reload without user intervention.' There are apparently no known exploits (yet), and Cisco have this advisory with a workaround and available fixes."
There are apparently no known exploits (yet)
I say we start a pool on how long yet will actually be, now that CERT released the info.
It's days like this I'm REALLY glad that I'm a unemployyed network engineer! This looks like a very serious headache!
-- I have a private email server in my basement.
This is why I always suggest alternatives to Cisco such as IP over Avian and actual implementaion on Linux
Rus
Cheap UK and US VPS
AT&T has been having problems all over the west coast the last 4 days. Ill bet even money this is why. There last 2 emails state they had no clue what was causing it and that random reboot's of routers were to be expected.
Im not Anonymous, Just Lazy.
Crackers`n`Soup
Sometimes, it's in the best interest of the public to have vulnerability information released directly when it is found out. It opens up the ability for hackers to create exploits before the manufacturers have a chance to find a way to stop it. Sure, releasing information on vulnerabilities for open source projects right away is usually a good idea, but that's due to the fact that with an open source project, the public has the ability to come up with a patch. In cases like these, perhaps it is best for the public to be left out until a proper solution or workaround has been developed by the vendors.
At least it only freezes the device. If you could make it send the same packet to some of it's router buddies, then freeze, this could get real bad, real fast.
====
Crudely Drawn Games
Here's the reccomendation for a temporary workaround using ACls:
Cisco recommends that all IOS devices which process IPv4 packets be configured to block traffic directed to the router from any unauthorized source with the use of Access Control Lists (ACLs). Legitimate traffic is defined as management protocols such as telnet, snmp or ssh, and configured routing protocols from explicitly allowed peers. All other traffic destined to the device should be blocked at the input interface.
Does "A rare sequence of crafted IPv4 packets sent directly to the device" mean a sequence utilizing one of these three protocols? If so then frigging tell us! If not, this is just a vague precautionary warning that really won't stop any user inside the network from exploiting the bug.
The TRUE details of the bug, including which protocol it uses, would help us put a nail in the coffin regarding the ACL workaround, but the Cisco bug tool isn't returning any information for the bugs they're talking about - specifically CSCea02355 and CSCdz71127.
While the army took time to celebrate the discover and safe return of Major Flaw it still maintained the need to continue the search for other missing top ranking officials. We spoke with a member of the search and recovery team soon after Major Flaw was discovered.
"It is great to have found Major Flaw but we are still very worried about the others. Our job here is not finished." said Private Data.
Colonel Panic has been spotted from time to time but the army has not yet been able to pinpoint his exact position. But the most gravest of fears are held for General Protection-Fault. Sightings of the General have been few and far between in the last few years. Some conspiracy theorists say that he is not actually missing but has disguised himself. Private Data would not confirm wether they are searching for a man of similar build to General Protection-Fault but dressed all in blue.
"She's a West Texas girl, just like me" - G.W Bush Iraqis
The claim that there are no exploits is false.
0 03 0717-blocked.shtml
Below is a note I received from my ISP about 2 hours before this was topic posted:
=-=-=-=-=-=-=-=-=-=-=
17/07/03 01.12 - 01.38 DOS Attack on Sydney PoPs
Incident
A DoS attack against the AN border router resulted in that router's CPU reaching 100% and triggering the same attack on the Perth gateway router which in turn brought down the Comindico Border router
Action
While all of the hardware remained 'up' nothing could be authenticated and therefore all traffic through the Sydney PoP ceased.
Resolution
Swiftel Engineering rebooted the Perth Gateway router clearing the DoS packets and that in turn allowed the Sydney routers to rebuild the BGP4 tables thus restoring the ability to process customer traffic.
Result
By 1.38 pm all traffic was flowing normally.
Future Elimination Of This Problem
The elimination of this type of new DoS attack has just been recognised and released by Cisco (today) and the workaround and fixes are documented in:
http://www.cisco.com/warp/public/707/cisco-sa-2
We are considering whether to implement the workarounds which may impact traffic such as ICQ and some games or upgrade the IOS's in all of our Cisco equipment.
We will inform you when that decision is made.
This is actually good news for Cisco, because security holes like this appear to be a prerequisite for getting a large Department of Homeland Security contract.
No, the advisory states that non-contract customers can send an email to tac@cisco.com and get access to a "free upgrade".
"Like millions of sysadmins cried out in terror -- then were silenced."
...on NANOG most of the day today. It looks like Cisco discovered the vulnerability in their own testing, notified major backbone providers (AT&T, Qwest, Sprint, L3, etc), who then scheduled emergency maintenance, which in turn tipped off savvy network engineers all over the place, who started wondering what was up, which in turn generated enough interest that bits and pieces leaked, and I bet Cisco figured better to release the advisory now and end the speculation than to wait till tomorrow. As for the "no exploit available", I had a router with an uptime of many many moons hang for no apparent reason tonight...while working on that I found the cisco advisory in my inbox. Could be a coincidence, but it's a strange one.
Twinkies sure taste good for something that is 68% air.
I'm in the Bay Area, and my Comcast (formerly ATTBI) cable modem connection has been having issues all day. This router kept crashing earlier today:
tbr1-p013601.sffca.ip.att.net [12.122.11.77] (hop #6 after my cable modem)
I have no idea what the problem is or whether it's related to this exploit, but it really stinks to have the connection continually crash. I actually haven't had problems in the last few months... until today. I hope this isn't a harbinger of things to come...
Simpli - Your source for San Jose dedicated servers and colocation!
What I really wonder wonder about is whether the vulnerability has been kept under wrap by the the Department of Homeland Security, just like they did with the Sendmail vulnerability of a short while ago, which was kept from the world for a couple of weeks. The US-military had at least a full week maintenance time before the rest of the world got it.
As a non-american I found this quite disturbing, since certainly with the Sendmail vulnerability, there was a risk of this being exploited by the US-governement against foreign nations. NOw, I know I am just being paranoid, but it does freak me if this would become standard operating procedure: 1. Vulnerability discovered 2. US government given ample time to protect itself 3. US government makes use of vulnerability 4. Us gov releases it to friendly nations 5. You get notified.
Cisco Cable Modems run a version of IOS. However they have private IP addresses on the cable side and pass thru the DHCP requests that your device(s) make to the providers DHCP server. Unless your cable provider's network has been compromised I doubt that this is related to your problem.
You may think me a tired, old, cynic. I'd have to disagree about the tired bit.
Why not just filter out all the packets with the evil bit set? This should fix the problem.
This post is encrypted twice with ROT-13. Documenting or attempting to crack this encryption is illegal.
To all Internap customers:
0 03 0717-blocked.shtml
Cisco Systems has released to the public notification of a vulnerability
in many versions of Cisco IOS which can create a Denial of Service on an
affected router. The details of the advisory can be viewed at the
following link:
http://www.cisco.com/warp/public/707/cisco-sa-2
No exploits which target this vulnerability have yet been identified.
Prior to the public notification, Cisco had contacted their major NSP
customers including Internap to inform us of this vulnerability. Internap
has identified IOS versions with the appropriate fix for the platforms in
our network and scheduled upgrades to our routers. Customers will receive
notification shortly of the window in which the routers you are homed to
will be upgraded. Due to the severity of this vulnerability these
upgrades are being performed as emergency maintenance.
Customers with questions about the possible impact of this vulnerability on
their own equipment are urged to read the notice at the link above or to
contact Cisco directly.
Twinkies sure taste good for something that is 68% air.
Don't misunderstand traffic going THROUGH the router with traffic directed TO the router. You probably want to control the latter because as a good netadmin you should know that this is good practise.
Boss: Look what one of our engineers said to a reporter !
Dogbert: (reading) "Our technology is putrid, but we compensate by ignoring complaints."
Boss: You know what would be more fun than fixing those problems ?
Dogbert: WITCH-HUNT !!!
What does "no exploits" mean?
No script kiddy tool for it yet?
Nobody's used it yet to take down routers?
Because the security advisory sure sounds like it's discovered an "exploit" on Cisco IOS routers to me.
Any self respecting coder can whip up something homemade to take advantage of the issue.
Is "no exploits" yet supposed to make us feel safer?
If a security hole is there, it's vulnerable. Calling it "unexploited for now" is just misleading and confusing.
Now let us step back a little.
:-) then we'd all be crying about how homogeneous networks/OS's etc are bad for security.
IF this had happened to our friends at Redmond (what do you mean 'if'
Now it's happened to a vendor with probably more pieces of kit attached to the public internet than anyone else (by a long chalk IMHO).
Do we cry, bad Cisco bad, no we just look at all the poor network admins who will get no sleep for the next 2 days....
Perhaps NOW people wil start looking at alternatives to Cisco.
Don't get me wrong I love Cisco kit, but I think the risk of Cisco everywhere is just about to hit home...