Cisco Flaw Opens Routers to Attack

Jack writes "Cisco is suffering from a serious flaw in its router operating system, which might allow execution of remote code: 'Cisco has warned of a new flaw in its IOS router operating system which might be used by attackers to launch denial of service attacks or take over IOS-based devices. The flaw causes to buffer overflow due to incorrect handling of user authentication credentials.'"

Comments

The Cisco Advisory

[MECC]

Here's a link to the cisco advisory
I noticed the linked article didn't have that link, and its viewable by the Internet public. Let's see how Cisco holds up to the mighty /. effect.

Re:The Cisco Advisory

[tweek]

Actually it depends on the need. Maybe not in the router market all the time but in other markets, yes. It's also all about cost.

I've recently turned into a HUGE Juniper fanboy recently. I was already an HP Procurve fanboy after some Cisco catalyst issues. That and price per port/performance trounces Cisco.

In our situation, we had a vpn provider running a single Cisco 3030 concentrator.A maxed out 3030 costs around 25 or 30k and can support 500 nailed down tunnels with 50MB/s of encrypted throughput.

Meanwhile two Netscreen 208s with core plus same day support cost us about 30k total.

Stats on the Netscreen? 1000 nailed down tunnels and 200MB/s of 3DES encrypted throughput.

These can also operate in an active/active setup and double the throughput (but not the tunnels).

Now the question really begs "Should Cisco have bought Netscreen instead of Altiga? In my mind yes. Netscreen's use of ASICs is what really gives them the power.

Since I've not had the experience of dealing with the Juniper routers, I don't have an equivilent model comparison. I do know though that Juniper uses the "pc-based" architecture just like Cisco in the router line. To give Cisco credit, I am pretty impressed with the horsepower boost in the 2800 line over the 2600.

I'm just waiting for Juniper to buy Foundry and be the beast that Cisco needs. That will fill out the product line QUITE nicely.

Re:The Cisco Advisory

[monkeydo]

Believe it or not, Cisco makes many products that don't run IOS.

Is this perhaps...

[max99ted]

...some fallout from http://it.slashdot.org/article.pl?sid=05/07/29/185 0234&tid=99&tid=172&tid=123&tid=218

Re:Best Practices 101

[b0r1s]

After reading advisory, this actually isn't a hole in the IOS authentication, but in the proxy authentication for FTP and Telnet.

This opens the whole somewhat (ie: it's open to an untrusted userbase by its nature), but the original point still stands as good general practices.

The Cisco IOS Firewall Authentication Proxy for FTP and/or Telnet Sessions feature in specific versions of Cisco IOS software is vulnerable to a remotely-exploitable buffer overflow condition.

Devices that do not support, or are not configured for Firewall Authentication Proxy for FTP and/or Telnet Services are not affected.

Devices configured with only Authentication Proxy for HTTP and/or HTTPS are not affected.

Affected Versions

[gulfan]

Affected versions include IOS 12.2ZH, IOS 12.2ZL, IOS 12.3, IOS 12.3T, IOS 12.4 and IOS 12.4T. IOS versions that are not vulnerable are IOS XR and IOS versions 12.2 and earlier, including 12.0S. This shouldn't be a problem for those Network Administrators that created access control lists for modifications for the router, however Cisco has issued a patch.

ip auth-proxy

[ctime]

The bug effects systems running ip auth-proxy , I feel bad for anyone that has to run it. I played with it a bit while experimenting wireless security schemes and I found it to be useless (to be fair it wasn't designed for it, either)

If you are someone you know are running any of the following versions of code, please think of the baby seals and upgrade. That is all.

Devices that are running the following release trains of Cisco IOS are affected if Firewall Authentication Proxy for FTP and/or Telnet Sessions is configured and applied to an active interface.
12.2ZH and 12.2ZL based trains 12.3 based trains 12.3T based trains 12.4 based trains 12.4T based trains

Re:old news?

[jd]

I think that was the IPv6 routing bug, which allowed programs to be remotely run, which Cisco admitted to shortly after.

Cisco IOS Firewall Authentication Proxy

[RaZ0r]

article text
Summary

The Cisco IOS Firewall Authentication Proxy for FTP and/or Telnet Sessions feature in specific versions of Cisco IOS software is vulnerable to a remotely-exploitable buffer overflow condition.

Devices that do not support, or are not configured for Firewall Authentication Proxy for FTP and/or Telnet Services are not affected.

Devices configured with only Authentication Proxy for HTTP and/or HTTPS are not affected.

Only devices running certain versions of Cisco IOS® are affected.

Cisco has made free software available to address this vulnerability. There are workarounds available to mitigate the effects of the vulnerability.

This means that only equipment that is configured to act as an authenticatoin proxy for FTP and/or telent are affected.

I work with cisco equpment every day and this is not a normal service to have configured. This exploit probably isn't as big of a deal as its being made out to be. Just my 2 cents...

Re:is this the flaw Michael Lynn tried to tell abo

[LarsG]

Lynn's presentation wasn't about any specific vulnerability (I think he did mention one vulnerability, which was patched some time before the presentation). It was generally thought that most Cisco vulnerabilities could only hang or reboot IOS. Lynn showed that you could inject code. Which makes vulnerabilities like this one a lot more dangerous, as an attacker can Own the router instead of just crashing it.

Details and Mike Lynn

[Effugas]

No. Mike's "first cut" was against the link-local IPv6 parser (a fact not disclosed publically by Mike, but by Cisco). Once in, he actually figured out how to execute arbitrary code -- something way harder than even Mike's slides describe.

He could get into pretty much any Cisco router w/ his attack, whereas this proxy attack isn't going to affect anything on the global net.

Re:Details and Mike Lynn

[monkeydo]

He could get into pretty much any Cisco router w/ his attack...

Except all the routers not running IPV6.

Re:Details and Mike Lynn

[Effugas]

Active by default.

Mike's attack was significant another front too -- getting an attack vector is one thing, actually using it is such a PITA that Jim Duncan of Cisco PSIRT (someone I know and highly respect) actually reacted with ... ahem ... "unexpectedly strong disbelief" when Mike said he could exploit the box using what he'd found.

Re:Details and Mike Lynn

[Effugas]

Routing is disabled. Doesn't mean the box doesn't parse IPv6 before trashing 'em.

As for the link-local -- the point of Mike's attack wasn't that he could take out arbitrary hosts, it was that shellcode on IOS was possible. The nasty thing is, on 100% Cisco networks (go look up Cisco Powered Network), you break the first hop, then the next, then the next, then the next...everything is link local when every hop is vulnerable.

Re:Latest Viruses

[jerw134]

You obviously failed Networking 101. A hub or switch is nothing like a hardware based firewall. You don't have a clue.