Slashdot Mirror
Cisco Confirms Regex Flaw in IOS
gattaca writes "Cisco has announced a confirmation of an unpatched denial of service vulnerability in Cisco IOS. From the NetPro Forum post: 'I have just discovered a regular expression that crashes the router. I suspect the error is because of division by zero. Since I work for the Enterprise, I do not have direct access to TAC. Please somebody report this to Cisco. I have tested it on ranges of routers (2611, 2821, 2851, 7206) and IOSes (12.0-12.4). All routers crashed with some type of BUS ERROR.
Command can be issued in user mode, therefore I think it can be considered as vulnerability to potentially cause DOS.'" Of course, the command has to be entered in user mode, so while potentially a vulnerability, chances are your local IOS-based router won't be DoSed via the bug any time soon.
Writing code that can parse for any given syntax is, well, pretty much as difficult as writing a parsing front-end to a compiler.
I.e. it is not trivial and it is fraught with danger.
Any time you allow the user to submit arbitrary, un-screened, un-filtered data, you're just asking for trouble.
Of course, I guess you could argue that the job of a RegEx parser is precisely to do the screening & the filtering for you, but it is not a trivial business, and anyone who approaches the problem as though it were a mere triviality is a fool.
I.e. from the security point of view, the RegEx parser is a firewall [and, in all likelihood, is the only firewall], hence anyone writing a RegEx parser has to assume that the user submitting the input is a blackhat, not a whitehat.
PS: And the problem undergoes manifold [if not infinite] complexification when you're dealing with languages [or "environments"] like HTML, Javascript, and XML, which can re-write themselves on the fly.
Buying Cisco equipment (typically - and through proper purchase channels) gives you access to TAC (Technical Assistance Center), worldwide support 24x7 for network emergencies and problems, as well as extensive troubleshooting support. When you buy Cisco these days, that is what you are mostly paying for. Try getting that level of assistance from Netgear, Linksys (ironically owned by Cisco), DLink, etc... You really can't - as they do not put that level of resource behind their products.
If a rogue has CLI access to your router, you have bigger issues. Proper filtering, TACACS and Logging, Out of Band Management makes this a non-issue.
The risk is almost the same as "reload" or the even more fun undocumented "test crash" commands.
Granted I do not think this vulnerability requires "enable" access, which does increase the risk. However, nobody should have any CLI to a router that you do not trust.
That said, I'm on AT&T's route server right now and I can clearly see that it's been abused by the regex bug:
Note the uptime and line noting the reason for the last reboot.
So, in short, looking glasses aren't susceptible to this bug, at least none of the dozens LG projects I've seen are susceptible to this). However publicly accessible route servers that are IOS-based and not run on Juniper routers or Quagga may very well be susceptible if the admin hasn't secured the box.