Slashdot Mirror

← Back to Stories (view on slashdot.org)

Cisco Flaw Opens Routers to Attack

Posted by CowboyNeal on from the right-where-it-hurts dept.

Jack writes "Cisco is suffering from a serious flaw in its router operating system, which might allow execution of remote code: 'Cisco has warned of a new flaw in its IOS router operating system which might be used by attackers to launch denial of service attacks or take over IOS-based devices. The flaw causes to buffer overflow due to incorrect handling of user authentication credentials.'"

109 comments

  1. defcon? by Anonymous Coward · · Score: 0

    Is this the same attack that didn't exist at defcon?

    1. Re:defcon? by earnest+murderer · · Score: 4, Funny
      Is this the same attack that didn't exist at defcon?

      No, this is the only existing issue on Cisco brand routers.

      The defcon attack isn't scheduled to exist until the patch is published in February.

      --
      Platform advocacy is like choosing a favorite severely developmentally disabled child.
    2. Re:defcon? by MightyMartian · · Score: 5, Funny

      There are no flaws in Cisco's IOS. If there was, no one would be allowed to talk about it, and anyone who did would be threatened and forced to recant. Thusly, there are no Cisco vulnerabilities. The Cisco Inquisition will take care of those who actually dare to question the sanctity of the Church of Cisco, and its most holy IOS. This whole topic is clearly in violation of that most sacred tenet, and thus the Cisco Inquisition has determined that Slashdot advocates heresy. It will be duly noted and CmdrTaco will be forced to recant the very existence of this topic.

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
    3. Re:defcon? by Anonymous Coward · · Score: 0

      Gak... it's the Church of the Flying Cisco Monster.

      I don't want to believe!

    4. Re:defcon? by commodoresloat · · Score: 3, Funny
      CmdrTaco will be forced to recant the very existence of this topic

      Yes but then the dupe will be posted, so this will start all over again.

    5. Re:defcon? by Anonymous Coward · · Score: 0

      Dark Tangent ( founder of Defcon )
      was dealing with court order that was brought
      upon DC and Blackhats during that time, when I
      was there. So it may be they wanna shut the doors on this one.

      --skyhigh

    6. Re:defcon? by Anonymous Coward · · Score: 0

      Eppur si BSOD! -- Galileo

    7. Re:defcon? by HeliumHigh · · Score: 1

      Yes but then the dupe will be posted, so this will start all over again.

      Maybe, just maybe this is the dupe!

      Either no-one has told me.. or no-one knows!

  2. The Cisco Advisory by MECC · · Score: 5, Informative


    Here's a link to the cisco advisory
    I noticed the linked article didn't have that link, and its viewable by the Internet public. Let's see how Cisco holds up to the mighty /. effect.

    --
    "We are all geniuses when we dream"
    - E.M. Cioran
    1. Re:The Cisco Advisory by ScrewMaster · · Score: 1

      Let's see how Cisco holds up to the mighty /. effect.

      Well, so far so good.

      --
      The higher the technology, the sharper that two-edged sword.
    2. Re:The Cisco Advisory by ackthpt · · Score: 1
      Let's see how Cisco holds up to the mighty /. effect.

      For the full bore, whole hog, bull moose /. effect it's best to post these articles in the morning EST/EDT.

      It would be amusing if of all presences on the internet, Cisco couldn't take it.

      --

      A feeling of having made the same mistake before: Deja Foobar
    3. Re:The Cisco Advisory by pseudochaotic · · Score: 1

      If they get /.ed, maybe now they'll rethink making such fast routers. :)

      --
      And the l33t shall inherit the 34r7h.
    4. Re:The Cisco Advisory by someonehasmyname · · Score: 1

      Cisco routers aren't fast compared to Juniper routers. I woudn't use a Cisco router for any pipe > 10 MB/s.

      --
      Common sense is not so common.
    5. Re:The Cisco Advisory by CDMA_Demo · · Score: 1

      Won't it be shameful if no difference exists between /. and DoS?

    6. Re:The Cisco Advisory by Anonymous Coward · · Score: 0

      So these routers aren't fast enough huh? Interestingly incorrect opinion you have there.

    7. Re:The Cisco Advisory by mlsmithjr · · Score: 1

      I still don't understand, after about 10 years of buffer overflow problems, how software developers keep writing crappy code like this. It's one thing to cut corner on application software here and there, but OS's and network protocol handlers!?!? I mean -- buffer overflows! What a stupid error to make. It didn't take me more than hearing 2 or 3 security breaches related to this kind of issue before I scrutinized my own code more carefully for such things. It's pretty sad that this problem still occurs.

    8. Re:The Cisco Advisory by PlasticMetal · · Score: 1

      Advisory statement:
      Products Confirmed Not Vulnerable
      Products that are not running Cisco IOS are not affected
      ...
      So linux is not affected. Happy?

      --
      Plastic & Metal. Is this sh*t worth livin' 4?
      Is diz sh*t worth dyin' 4?
    9. Re:The Cisco Advisory by bladesjester · · Score: 3, Insightful

      You'd be amazed at the things that you'll screw up on code-wise during a crunch period when you've been up for days on end trying to meet the deadlines that the pointy-hairs have set for you.

      We're still human in theory at least, so mistakes will happen and in a piece of software that's *that* big, it's really easy to miss them.

      --
      Everything I need to know I learned by killing smart people and eating their brains.
    10. Re:The Cisco Advisory by tweek · · Score: 2, Informative

      Actually it depends on the need. Maybe not in the router market all the time but in other markets, yes. It's also all about cost.

      I've recently turned into a HUGE Juniper fanboy recently. I was already an HP Procurve fanboy after some Cisco catalyst issues. That and price per port/performance trounces Cisco.

      In our situation, we had a vpn provider running a single Cisco 3030 concentrator.A maxed out 3030 costs around 25 or 30k and can support 500 nailed down tunnels with 50MB/s of encrypted throughput.

      Meanwhile two Netscreen 208s with core plus same day support cost us about 30k total.

      Stats on the Netscreen? 1000 nailed down tunnels and 200MB/s of 3DES encrypted throughput.

      These can also operate in an active/active setup and double the throughput (but not the tunnels).

      Now the question really begs "Should Cisco have bought Netscreen instead of Altiga? In my mind yes. Netscreen's use of ASICs is what really gives them the power.

      Since I've not had the experience of dealing with the Juniper routers, I don't have an equivilent model comparison. I do know though that Juniper uses the "pc-based" architecture just like Cisco in the router line. To give Cisco credit, I am pretty impressed with the horsepower boost in the 2800 line over the 2600.

      I'm just waiting for Juniper to buy Foundry and be the beast that Cisco needs. That will fill out the product line QUITE nicely.

      --
      "Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
    11. Re:The Cisco Advisory by Anonymous Coward · · Score: 0

      Sing it sister! We've done a number of Cisco vs. Juniper evaluations lately (I work for a massive broadband provider) and Juniper beats 'em every time.

      We've implemented both the Netscreen stuff for IPSec and Juniper's traditional line for aggregation and services routing. If we had gone with Cisco, our costs would have been substantially higher and we would already be running into scaling issues.

      Incidentally, my money is on Extreme for Juniper's next purchase ;)

    12. Re:The Cisco Advisory by monkeydo · · Score: 4, Informative

      Believe it or not, Cisco makes many products that don't run IOS.

      --
      Si vis pacem, para bellum
      The only thing more annoying than a Libertarian is an (un|mis)informed Libertarian
    13. Re:The Cisco Advisory by PlasticMetal · · Score: 1

      Just wanted to calm down /. crowd, hope they'll sleep better now.

      --
      Plastic & Metal. Is this sh*t worth livin' 4?
      Is diz sh*t worth dyin' 4?
  3. Best Practices 101 by b0r1s · · Score: 3, Insightful

    It's been pretty standard to ACL off authentication methods from unknown or untrusted networks for some time.

    If you can only auth from a known network, then an overrun in that auth process still requires access to a restricted location, which will stop 99% of attacks (which are usually automated these days).

    --
    Mooniacs for iOS and Android
    1. Re:Best Practices 101 by b0r1s · · Score: 3, Informative
      After reading advisory, this actually isn't a hole in the IOS authentication, but in the proxy authentication for FTP and Telnet.

      This opens the whole somewhat (ie: it's open to an untrusted userbase by its nature), but the original point still stands as good general practices.


      The Cisco IOS Firewall Authentication Proxy for FTP and/or Telnet Sessions feature in specific versions of Cisco IOS software is vulnerable to a remotely-exploitable buffer overflow condition.

      Devices that do not support, or are not configured for Firewall Authentication Proxy for FTP and/or Telnet Services are not affected.

      Devices configured with only Authentication Proxy for HTTP and/or HTTPS are not affected.
      --
      Mooniacs for iOS and Android
    2. Re:Best Practices 101 by JPriest · · Score: 2

      The key statement there is "and/or Telnet Services". Almost every single Cisco router I have seen is running telnet. Lots of people are still using 12.2 though.

      --
      Saying Java is nice because it works on all OS's is like saying that anal sex is nice because it works on all genders.
    3. Re:Best Practices 101 by Packet+Pusher · · Score: 1

      The title is worded a bit badly. It's for Proxy telnet services not telnet services itself.

  4. Latest Viruses by ChrisGilliard · · Score: 0, Offtopic

    The latest viruses are getting pretty creepy. On the public network where I work, we recently plugged a Windows XP laptop in that had just been installed without anti-virus. There are apparently so many viruses going around on our network that within 10 minutes, the computer had 12 viruses that were picked up just through viruses that connect in remotely through ports that have not been "firewalled". This explains why I use Solaris or Linux for my desktop system.

    --
    No Sigs!
    1. Re:Latest Viruses by ackthpt · · Score: 2, Interesting
      The latest viruses are getting pretty creepy. On the public network where I work, we recently plugged a Windows XP laptop in that had just been installed without anti-virus. There are apparently so many viruses going around on our network that within 10 minutes, the computer had 12 viruses that were picked up just through viruses that connect in remotely through ports that have not been "firewalled".

      Sounds like your problem isn't the PC, Windows or your network, but your network practices. We're pretty good about stripping attachments, filtering spam and having firewalls in place, but the extra yard is taking a PC off someone's desk and making sure many people around them know just who was doing what to bring the beastie in.

      I was having trouble with a connection, last December and disabled my firewall. Within 40 seconds something had already got in. The firewall went back up and I sorted the problems out with it in place.

      --

      A feeling of having made the same mistake before: Deja Foobar
    2. Re:Latest Viruses by ChrisGilliard · · Score: 0

      In a small company I agree, you can definitly keep track of who is doing what on the network and knowing who brought the virus in. But when you work at a company with more than 30,000 employees that can be difficult. I think the lesson is: go through a hub/switch before plugging into any network.

      --
      No Sigs!
    3. Re:Latest Viruses by mzwaterski · · Score: 1

      Why would a hub help?

    4. Re:Latest Viruses by ChrisGilliard · · Score: 0

      The viruses attack ports on Windows XP, since your hub or switch is presumably not running Windows XP, you the virus will not be able to take control of your hub. It's sort of like a hardware based firewall.

      --
      No Sigs!
    5. Re:Latest Viruses by gkuz · · Score: 1
      The latest viruses are getting pretty creepy. On the public network where I work, we recently plugged a Windows XP laptop in that had just been installed without anti-virus.

      What in the world does this have to do with a Cisco IOS vulnerability?

    6. Re:Latest Viruses by jerw134 · · Score: 2, Informative

      You obviously failed Networking 101. A hub or switch is nothing like a hardware based firewall. You don't have a clue.

    7. Re:Latest Viruses by mzwaterski · · Score: 1

      I think that you mean a router. A hub doesn't have an address on the network.

    8. Re:Latest Viruses by Anonymous Coward · · Score: 0

      Next time turn the XP firewall on before connecting to the network. It's just not that hard.

  5. Dupe by Namronorman · · Score: 4, Funny

    Dupe! Oh.... Nevermind, it seems like just yesterday a serious flaw was found in CISCO. I hope this doesn't become common place for CISCO

    --
    $fortune
    Tomorrow has been canceled due to lack of interest.
    1. Re: Dupe by Black+Parrot · · Score: 1


      > Dupe! Oh.... Nevermind, it seems like just yesterday a serious flaw was found in CISCO. I hope this doesn't become common place for CISCO

      It's getting hard to tell when it's a dupe on Slashdot vs. when it's a dupe at Cisco.

      --
      Sheesh, evil *and* a jerk. -- Jade
  6. Is this perhaps... by max99ted · · Score: 3, Informative

    ...some fallout from http://it.slashdot.org/article.pl?sid=05/07/29/185 0234&tid=99&tid=172&tid=123&tid=218

    --

    Please stop APK.. you're only hurting yourself.

    1. Re:Is this perhaps... by pbhj · · Score: 1

      Yes I guess it could be related to that dudes exploits.

      ----

      >>> Theology is like being in a dark room, looking for a black cat that isn't there and shouting "I found it!"

      If it's a completely dark room. How do you know there is no cat in there? Of course randomly shouting "I found it!" is stupid. But just because someone finds the cat and you can't see it ... that doesn't mean it's not there.

      HTH

    2. Re:Is this perhaps... by monkeydo · · Score: 1

      Probably not related, other than Lynn's findings explain the obviously cya statement "and potentially an arbitrary code execution attack". which is normally not in their security advisories.

      There's no evidence that this vulnerability is exploitable as anything other than a DoS, inflamatory headline notwithstanding.

      --
      Si vis pacem, para bellum
      The only thing more annoying than a Libertarian is an (un|mis)informed Libertarian
    3. Re:Is this perhaps... by Gaurang · · Score: 1

      > Theology is like being in a dark room, looking for a black cat that isn't there and shouting "I found it!"

      If it's a completely dark room. How do you know there is no cat in there? Of course randomly shouting "I found it!" is stupid. But just because someone finds the cat and you can't see it ... that doesn't mean it's not there.

      I completely agree. The onlooker normally is not able to decipher whether the finder actually found the cat or not, because the room is dark. And this room's darkness makes the only way possible to decipher is to experience it yourself.

      --
      I have found a solution to Riemann's Hypothesis, but have run out of spac
    4. Re:Is this perhaps... by fbjon · · Score: 1

      Unfortunately, even the person finding the cat can never sure he actually found it, no matter how much he claims so.

      --
      True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
    5. Re:Is this perhaps... by Infamous+Tim · · Score: 1

      Unfortunately, even the person finding the cat can never sure he actually found it, no matter how much he claims so.

      bullshit.
      According to your thinking: If something looks like a duck, feels like a duck, quacks like a duck, behaves like a duck, and even smells like a duck, then ... we still can never be fully 100% sure it's truly a duck.

      --
      checking for libvirus... no
      ERROR, libvirus.so not found, terminating
    6. Re:Is this perhaps... by fbjon · · Score: 1

      Exactly. Just because your external senses tell you something, doesn't mean you can always trust them. And with God, no external sense will tell you anything, it's all in your own mind. Do you trust your own brain to be infallible?

      --
      True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
    7. Re:Is this perhaps... by Gaurang · · Score: 1

      Exactly. Just because your external senses tell you something, doesn't mean you can always trust them. And with God, no external sense will tell you anything, it's all in your own mind. Do you trust your own brain to be infallible?

      Isnt it your mind that is saying this?

      Anyway, look at it this way.

      Your trust in external senses more than mind lies in the fact that senses dont lie, while mind can imagine anything it wants to.

      But, you will agree, that we are beings of the mind. "We" exist in the mind; we decide, we feel; we think; we judge; whatever we do, culminates in the mind.

      If the mind feels something; it is more important for us than anything that external sense or logic can ever provide.

      If you beleive in God, and find bliss, then there is nothing else that is important.

      My personal experience has been that my highest moments of happiness have come when I was one with God, or completely submitted to him.

      YMMV.

      --
      I have found a solution to Riemann's Hypothesis, but have run out of spac
  7. is this the flaw Michael Lynn tried to tell about? by Gruturo · · Score: 2, Interesting

    Is this the flaw Cisco was trying to keep secret and that caused Michael Lynn to resign his job in order to be free to speak about?

    Appeared a little over a month ago right here

    --

    Vacuum cleaners suck. Kings rule.
  8. Small companies? by PtM2300 · · Score: 1

    Does this mainly just impact smaller companies? I'm not sure if major corporations use routers with the firewall feature set, rather a true firewall instead. If that's the case, there shouldn't be huge consequences for this. I doubt small companies that would use the firewall feature set are hacker targets as much as the larger corps are.

    1. Re:Small companies? by temojen · · Score: 1

      Any internet connected device with a vulnerability is a hacker target. At the least a rooted router can be used to hide the true source of attacks against more interesting targets. A router is much preferable to a desktop for this purpose as it's already designed to do this. Also a router is likely to have a fast, stable connection.

    2. Re:Small companies? by hal9000(jr) · · Score: 3, Interesting

      Read the advisory.
      The affected subsystem is not the firewall, but the authentication proxies for ftp and telnet. It is doubtful that those features are being used all that much.
      The advisory also list a set of ACL that should suffice in most cases until a patch is issued.
      If this was a problem in the firewall or ACL subsystem, it would be a bigger issue because many companies use them to place a reduced ruleset for all traffic that should be blocked in all directions like netbios, snmp, etc.

  9. old news? by Chimera512 · · Score: 1

    i think i remeber reading about the guy that broke this at a confrence a few months back...

    1. Re:old news? by jd · · Score: 2, Informative

      I think that was the IPv6 routing bug, which allowed programs to be remotely run, which Cisco admitted to shortly after.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
  10. Coral Cache version by Spy+der+Mann · · Score: 1

    This will help them hold up to the mighty /. effect (let's give them a break, no unnecessary burdens)
    Advisory

    1. Re:Coral Cache version by CDMA_Demo · · Score: 1

      This service has been spotted crawling at a slower pace than epsilon miles a day.

  11. Affected Versions by gulfan · · Score: 5, Informative

    Affected versions include IOS 12.2ZH, IOS 12.2ZL, IOS 12.3, IOS 12.3T, IOS 12.4 and IOS 12.4T. IOS versions that are not vulnerable are IOS XR and IOS versions 12.2 and earlier, including 12.0S. This shouldn't be a problem for those Network Administrators that created access control lists for modifications for the router, however Cisco has issued a patch.

  12. ip auth-proxy by ctime · · Score: 5, Informative
    The bug effects systems running ip auth-proxy , I feel bad for anyone that has to run it. I played with it a bit while experimenting wireless security schemes and I found it to be useless (to be fair it wasn't designed for it, either)

    If you are someone you know are running any of the following versions of code, please think of the baby seals and upgrade. That is all.

    Devices that are running the following release trains of Cisco IOS are affected if Firewall Authentication Proxy for FTP and/or Telnet Sessions is configured and applied to an active interface.
    12.2ZH and 12.2ZL based trains 12.3 based trains 12.3T based trains 12.4 based trains 12.4T based trains

  13. Forced admin by Anonymous Coward · · Score: 0

    Wouldn't it be interesting if a router company (not naming names here) used a flaw in its router software/firmware to justify forced software/firmware upgrades instituted remotely by said router company? And wouldn't it also be interesting if a particular government or governments co-opted that forced patching process to secretly attach surveillance capabilities to various routers?

  14. sssshhhhh by jshaped · · Score: 4, Funny

    quiet everbody....
    if nobody knows, then nothing's wrong....

    1. Re:sssshhhhh by Anonymous Coward · · Score: 0, Insightful

      Interestingly enough, there is some truth to that. Lets face it, if a vulnerability is fixed in a patch before it is announced, then there is going to be less chance to abuse it.

      However, many companies for whatever reason seem to take ages to release a patch. At this point, it's a good idea to publicly embarass them by releasing details.

      Anyone who releases a proof-of-concept exploit is just completely bloody irresponsible. I got a phishing scam email a while back with a proof-of-concept used in it verbatim. Giving the kiddies the tools they need does not improve the situation.

      And now I eagerly await the first idiot who replies to this with the same cliche crap about 'security through obscurity'.

    2. Re:sssshhhhh by WindBourne · · Score: 0

      And yet, it is obvious that you believe in "obscurity is real security" crap.

      --
      I prefer the "u" in honour as it seems to be missing these days.
    3. Re:sssshhhhh by jshaped · · Score: 2, Interesting

      and yet still, it is obvious you cannot see my sense of humor.

    4. Re:sssshhhhh by Anonymous Coward · · Score: 0

      Hiding the details of the exploit obviously doesn't completely stop the abuse of it, but it will reduce it. Go on, spout out some slashdot groupthink crap. You know you want to.

    5. Re:sssshhhhh by WindBourne · · Score: 1

      Yours, yes. The ACs, no.

      --
      I prefer the "u" in honour as it seems to be missing these days.
    6. Re:sssshhhhh by Cervantes · · Score: 2, Funny
      quiet everbody....
      if nobody knows, then nothing's wrong...

      Excuse me sir, it's bad form for Cisco employees to post in this story.

      --
      If I knew the wedgies I gave you back in 6th grade would have resulted in this . . . I might have taken a moments pause.
  15. Further... by burtdub · · Score: 3, Interesting

    A Crisco flaw has left the routers open to deep pan frying.

    1. Re:Further... by superpulpsicle · · Score: 2, Insightful

      I have a close friend who worked at Cisco for a while. The company had massive layoffs in 2001, followed by countless little series of layoffs in 2002, 2003. Tons of good engineers were supposedly let go. You wonder if the lack of engineering resources is beginning to catch up with them. All these years in the trenches shorthanded will leave the product more vulnerable than ever.

    2. Re:Further... by Halvy · · Score: 0


      haha, i thought your sig was an advertisment for some new generic Sun OS product.. so i bit! (u but whole) lol ;)

      --
      I will gladly loose all of life's battles.. in order to win the war..
  16. It applies to most Cisco IOS-based equipment by postbigbang · · Score: 1

    And so, if you have an IOS object, it might be a good idea to read the advisory, that is, if your network is still up.

    --
    ---- Teach Peace. It's Cheaper Than War.
  17. Cisco IOS Firewall Authentication Proxy by RaZ0r · · Score: 5, Informative

    article text
    Summary

    The Cisco IOS Firewall Authentication Proxy for FTP and/or Telnet Sessions feature in specific versions of Cisco IOS software is vulnerable to a remotely-exploitable buffer overflow condition.

    Devices that do not support, or are not configured for Firewall Authentication Proxy for FTP and/or Telnet Services are not affected.

    Devices configured with only Authentication Proxy for HTTP and/or HTTPS are not affected.

    Only devices running certain versions of Cisco IOS® are affected.

    Cisco has made free software available to address this vulnerability. There are workarounds available to mitigate the effects of the vulnerability.

    This means that only equipment that is configured to act as an authenticatoin proxy for FTP and/or telent are affected.

    I work with cisco equpment every day and this is not a normal service to have configured. This exploit probably isn't as big of a deal as its being made out to be. Just my 2 cents...

    --


    - Think for yourself, question authority.-
    1. Re:Cisco IOS Firewall Authentication Proxy by PtM2300 · · Score: 1

      Amen Brotha

    2. Re:Cisco IOS Firewall Authentication Proxy by bizitch · · Score: 1

      Thank you - I mean this is an extremely grainular hole in an otherwise rock solid piece of software.

      That headline really scared the crap out of me at first.

      --
      ---- "Logoff! That cookie shit makes me nervous!" - A. Soprano
  18. Re:is this the flaw Michael Lynn tried to tell abo by LarsG · · Score: 4, Informative

    Lynn's presentation wasn't about any specific vulnerability (I think he did mention one vulnerability, which was patched some time before the presentation). It was generally thought that most Cisco vulnerabilities could only hang or reboot IOS. Lynn showed that you could inject code. Which makes vulnerabilities like this one a lot more dangerous, as an attacker can Own the router instead of just crashing it.

    --
    If J.K.R wrote Windows: Puteulanus fenestra mortalis!
  19. Re:is this the flaw Michael Lynn tried to tell abo by Anonymous Coward · · Score: 0

    No, it is not. The Lynn/Cisco flaw had to do with IPv6, and this (From RTFA = Cisco Security Advisory link not the BS link provided in the parent post) has no such dependancy.

    Yes... I have seen the slides, and it opened up my mind. I saw the slides (old song... Ace of Base) ;-)

  20. Re:is this the flaw Michael Lynn tried to tell abo by Anonymous Coward · · Score: 0

    pffft! I'm not concerned. Call me when they pwn my router... or maybe pwntz0r it...

  21. Details and Mike Lynn by Effugas · · Score: 5, Informative

    No. Mike's "first cut" was against the link-local IPv6 parser (a fact not disclosed publically by Mike, but by Cisco). Once in, he actually figured out how to execute arbitrary code -- something way harder than even Mike's slides describe.

    He could get into pretty much any Cisco router w/ his attack, whereas this proxy attack isn't going to affect anything on the global net.

    1. Re:Details and Mike Lynn by monkeydo · · Score: 2, Informative

      He could get into pretty much any Cisco router w/ his attack...

      Except all the routers not running IPV6.

      --
      Si vis pacem, para bellum
      The only thing more annoying than a Libertarian is an (un|mis)informed Libertarian
    2. Re:Details and Mike Lynn by Effugas · · Score: 2, Informative

      Active by default.

      Mike's attack was significant another front too -- getting an attack vector is one thing, actually using it is such a PITA that Jim Duncan of Cisco PSIRT (someone I know and highly respect) actually reacted with ... ahem ... "unexpectedly strong disbelief" when Mike said he could exploit the box using what he'd found.

    3. Re:Details and Mike Lynn by monkeydo · · Score: 1
      No, it isn't:
      Defaults

      IPv6 unicast routing is disabled.


      And furthermore, the exploit only works if you can generate packets local to the router:
      Summary

      Cisco Internetwork Operating System (IOS®) Software is vulnerable to a Denial of Service (DoS) and potentially an arbitrary code execution attack from a specifically crafted IPv6 packet. The packet must be sent from a local network segment. Only devices that have been explicitly configured to process IPv6 traffic are affected. Upon successful exploitation, the device may reload or be open to further exploitation.


      Thus, your assertion that Lynn could succesfully attack "pretty much any router" appears to have no basis in fact.
      --
      Si vis pacem, para bellum
      The only thing more annoying than a Libertarian is an (un|mis)informed Libertarian
    4. Re:Details and Mike Lynn by Effugas · · Score: 2, Informative

      Routing is disabled. Doesn't mean the box doesn't parse IPv6 before trashing 'em.

      As for the link-local -- the point of Mike's attack wasn't that he could take out arbitrary hosts, it was that shellcode on IOS was possible. The nasty thing is, on 100% Cisco networks (go look up Cisco Powered Network), you break the first hop, then the next, then the next, then the next...everything is link local when every hop is vulnerable.

    5. Re:Details and Mike Lynn by monkeydo · · Score: 1

      The Cisco advisory for the link-local parser vulnerability states very clearly that if IPV6 routing is turned off, the router is not vulnerable. I even pasted that part of the advisory into the message you are replying to. Have you not read the advisory, or do you have evidence that it's wrong? If it's wrong, a lot of people would be interested in seeing it, since most people who aren't running IPV6 haven't patched for this vulnerability. I guess whoever modded your post informative has access to this same secret information, too.

      I know what Mike's point was, but I'm not sure what your point was when you said, "He could get into pretty much any Cisco router w/ his attack, whereas this proxy attack isn't going to affect anything on the global net." Mike's attack works on local routers, and yes, in theory could hop from router to router. But to be a useful attack against a remote target, you would need an chain of vulnerable routers from you to the target network. Add the fact that both attacks require a feature that isn't running on most routers in the public Internet and it makes the practicality of Mike's attack about equal (meaning very, very low) to this one.

      I guess Cisco is just the current popular FUD target.

      --
      Si vis pacem, para bellum
      The only thing more annoying than a Libertarian is an (un|mis)informed Libertarian
  22. Slashdot sensationalism by libra-dragon · · Score: 1

    I can't believe this article is getting this level of attention. After reading the advisory on Cisco.com (BTW, not linked to the article) I agree it's a serious flaw in IOS/FW, but there's probably less than 50 sites in the whole world using this feature.

    Additionally, the referenced article on IT Observer is the editorial equivalent of a steaming pile of dog crap.

    "Symantec has raised the vulnerability threat level and advised to disable firewall and authentication until their IOS is patched."

    Not only is the paraphrasing blatently ignorant of _Cisco's_ mitigation advice, they're making reference to Symantec.

  23. It's a Mitzvah by putko · · Score: 2, Interesting

    This SHOULD happen.

    It's a Mitzvah that this befalls Cisco. As previously mentioned here, they have no trouble ruining the lives of those who attempt to help make a more secure world by improving their product.

    A pox on their house.

    It is allowed that hackers make worms that exploit Cisco hardware and disrupt the businesses of those who stupidly subsidize such misanthropic activities.

    --
    http://www.thebricktestament.com/the_law/when_to_s tone_your_children/dt21_18a.html
    1. Re:It's a Mitzvah by Anonymous Coward · · Score: 1, Interesting

      You do realize that the post you just made probably had to pass through a Cisco router before it arrived here, right?

  24. Re:My complaint about Cisco... by gkuz · · Score: 1

    I don't know what's funnier, this troll or the fact that somebody actually modded it "Informative".

  25. doesn't bother me by Anonymous Coward · · Score: 0

    I've been running a Cisco-free network for years.

    My Bay Networks router has NEVER failed, nor been compromised. It does everything I want it to do and then some. Paid for long ago. Just keeps running.

    There are LOTS of alternatives to Cisco. People just need to think and look. Funny, it will probably also cost less, and you won't have to deal with the obnoxious, arrogant, know-it-all Cisco field people, either.

    1. Re:doesn't bother me by Vorondil28 · · Score: 1

      I am an obnoxious, arrogant, know-it-all Cisco field person, you insensitive clod!

      --
      This sig rocks the casbah.
  26. Nobody to sue? by HermanAB · · Score: 1

    What I'd like to know is who Cisco is going to sue over this bug... ;-)

    --
    Oh well, what the hell...
  27. I'll pray for you... by HermanAB · · Score: 1

    Geezo, that piece must come from an incredibly bad Psychology text book. I'll pray for the poor students that have to suffer through those classes...

    --
    Oh well, what the hell...
  28. Take a look at Cisco's mischief and wrongdoing by Anonymous Coward · · Score: 0

    What, you thought they were angels?

    http://malfeasance.50megs.com/

  29. Oh, Cisco! by ScrewMaster · · Score: 1

    Oh, Pancho!

    --
    The higher the technology, the sharper that two-edged sword.
  30. Who suffers? by Anonymous Coward · · Score: 0

    Cisco isn't suffering from this flaw, IT administrators and end users are.

  31. Hunting Routers by netrangerrr · · Score: 0

    Shhhhhhhhh - - be vewy vewy quiet. I'm hunting wouters....

    --
    "As for the future, your task is not to foresee it, but to enable it." - Antoine de Saint-Exupery
  32. Are VLANs out of style? by Anti-Trend · · Score: 2
    Doesn't anybody use VLANs anymore? Maybe I'm ignorant here (it's a big world and all), but why should Windows clients be allowed to talk to eachother on the network? Especially if there are VPN nodes and/or soft-spots in the network implementation? Simple VLANs and the usage of DMZ's for outward-facing servers have worked for us so far; any virus infections have been localized to a PC at a time. There's always the ol' email entry point, but that's what clamav is for, right? ;)

    Thanks,

    -AT

    --
    Working in a DevOps shop is like playing in a band made up entirely of keytarists.
    1. Re:Are VLANs out of style? by Anonymous Coward · · Score: 1, Insightful

      Doesn't anybody use VLANs anymore? Maybe I'm ignorant here (it's a big world and all), but why should Windows clients be allowed to talk to eachother on the network?

      Would you please describe your VLAN solution that prevents Windows clients from talking with each other on the netowrk while allowing them to talk to various servers. Please address how the solution scales to support implementaitons with tens of thousands of clients, as well. I'm geniounely curious.

    2. Re:Are VLANs out of style? by Floody · · Score: 2, Insightful

      Doesn't anybody use VLANs anymore? Maybe I'm ignorant here (it's a big world and all), but why should Windows clients be allowed to talk to eachother on the network? Especially if there are VPN nodes and/or soft-spots in the network implementation? Simple VLANs and the usage of DMZ's for outward-facing servers have worked for us so far; any virus infections have been localized to a PC at a time. There's always the ol' email entry point, but that's what clamav is for, right? ;)

      vlans don't inhibit broadcast or unicast traffic on the same vlan, so unless each workstation is on a separate vlan (which I can't imagine, as it wouldn't scale), vlans aren't useful for isolating workstations from each other. They are, of course, useful for isolating workstations from other network devices.

  33. re: small companys? by Halvy · · Score: 0

    What do you consider a true firewall?

    I mean, I'v never seen or heard that term.

    From my understanding a firewall is ANY procedure that directs (ie allows/disallows) and detects traffic on a network.

    Do you mean a 'hardware' (cisco's) as opposed to 'software' ONLY?

    If so, cisco's (is all FIRMWARE), as in SOFT-WARE, ie. embeded in hardware permanently (unless flashed by user).

    Or am I missing something here.

    I don't meen to start a pissing contest or anything.. it is just that there is sooo much to learn and confusion out there.. that when I see a term I am not familiar with, I investigate :)

    --
    I will gladly loose all of life's battles.. in order to win the war..
  34. Re:Is this perhaps..& ok I'll feed Mr. Troll. by Halvy · · Score: 0

    Theology is like being in a dark room, looking for a black cat that isn't there and shouting "I found it!"

    Science is like being in a dark universe, looking for a black hole that isn't there and shouting "I found it!".

    lol ;)

    --
    I will gladly loose all of life's battles.. in order to win the war..
  35. i hope the slashdot crowd isnt as slow as the post by Anonymous Coward · · Score: 0

    Cisco Issues Fixes for Vulnerable Web Routershttp://www.eweek.com/article2/0,1895,185649 7,00.asp/
    Seeing as it the patch was issued yesterday, or even the day before.

  36. read between the lines by timmarhy · · Score: 2, Interesting

    look at the hidden meaning here. cisco censor a security researcher, and now they have a new vunerability on their hands. get ready for an avalanche of these has angry hackers make an example of cisco.

    --
    If you mod me down, I will become more powerful than you can imagine....
  37. Re:is this the flaw Michael Lynn tried to tell abo by sonictheboom · · Score: 1

    actually he showed that you could get root shell. this is why Cisco tried so hard to stop him. this was very very major. the presentation is available in the free (from Bush) world.

  38. It's a shame... by ChePibe · · Score: 1

    What a pity that Think Geek stopped selling those "I am Enabled" shirts. Sounds like the market for those is about to increase... ;-)

  39. Use the hole to close itself up by pestilence669 · · Score: 1

    Since a vulnerability exists that lets you run remote code, why not make use of that vulnerability to patch itself? It's almost elegant if you think about it... a problem that becomes the solution to end itself. Under the right circumstances, this isn't an impossible thing to do.

    When I'm up against a serious bug, remote code execution for instance, I write a test case to consistently reproduce it. I do a full analysis on the affected code and any dependencies. Before I fix the problem, I know everything about it. I might be wrong, but I think that Cisco probably does this too.

    I'm trying to say is that Cisco probably builds usable exploits before firmware updates. You need some form of an exploit to test if the fix actually worked. The professional software companies that I've come across all require test cases for bug fixes. I can't imagine that Cisco is any different.

    Even if I'm wrong about their software development processes, they could still do it if they wanted to. It is very possible with the right vulnerability. I could see a company run by software engineers pulling it off.

    Wait, never mind. This is a horrible idea. You'd be giving script kiddies code to attack the holes of slow adopters. Eek. Scratch this one. At least the idea sounds cool.

  40. I blame it on... by Andy_R · · Score: 2, Funny

    My leds are always flashn'
    And it wouldn't be a bad thing
    But I don't get no packets
    And thats no lie

    We spent the night in Cisco
    At every kind of distro
    From that night I kissed
    Our data goodbye

    Chorus:
    Don't blame it on sunshine
    Don't blame it on moonlight
    Don't blame it on good times
    Blame it on the router

    Don't blame it on sunshine
    Don't blame it on moonlight
    Don't blame it on good times
    Blame it on the router

    The nasty virus bugs me
    But somehow it has drugged me
    Outbound ports get me
    On my feet

    I've changed my life completely
    I've seen the data leave me
    My baby just can't take
    Her PCs offline

    Chorus:
    Don't blame it on sunshine
    Don't blame it on moonlight
    Don't blame it on good times
    Blame it on the router

    I just can't
    I just can't
    I just can't control my ports...

    --
    A pizza of radius z and thickness a has a volume of pi z z a
  41. The Best Part About the Article by SenFo · · Score: 1

    Symantec has raised the vulnerability threat level and advised to disable firewall and authentication until their IOS is patched."

    Sure, I'll get right on disabling my firewall so the world can take over the even more insecure [unfortunate] 95% Windows network at my work.

    --
    My lame blog.
  42. Aw, aren't the trolls cute, they feed each other.. by Anonymous Coward · · Score: 0

    I gotta calls'm as I sees'm.