Slashdot Mirror
Cisco Confirms Regex Flaw in IOS
gattaca writes "Cisco has announced a confirmation of an unpatched denial of service vulnerability in Cisco IOS. From the NetPro Forum post: 'I have just discovered a regular expression that crashes the router. I suspect the error is because of division by zero. Since I work for the Enterprise, I do not have direct access to TAC. Please somebody report this to Cisco. I have tested it on ranges of routers (2611, 2821, 2851, 7206) and IOSes (12.0-12.4). All routers crashed with some type of BUS ERROR.
Command can be issued in user mode, therefore I think it can be considered as vulnerability to potentially cause DOS.'" Of course, the command has to be entered in user mode, so while potentially a vulnerability, chances are your local IOS-based router won't be DoSed via the bug any time soon.
if your own people have to do it?
Nitpick: if it were a division by zero fault, would it really trigger a bus error, or more likely a ... division by zero error?
There are no karma whores, only moderation johns
FTA: "I have just discovered a regular expression that crashes the router. I suspect the error is because of division by zero."
Reminds me of:
Patient: "My arm hurts when I do this." <wiggles arm>
Doctor: "Then don't do that."
The solution is obvious: don't use that regex/divide by zero. Duhhhh. Problem solved. Thank you, come again.
Infiltrated dot Net
"Since I work for the Enterprise, I do not have direct access to TAC. "
Yes, Capt. Kirk can be very protective of the TAC.
Alex, I'll take keybindings not used by Emacs for $400....
Writing code that can parse for any given syntax is, well, pretty much as difficult as writing a parsing front-end to a compiler.
I.e. it is not trivial and it is fraught with danger.
Any time you allow the user to submit arbitrary, un-screened, un-filtered data, you're just asking for trouble.
Of course, I guess you could argue that the job of a RegEx parser is precisely to do the screening & the filtering for you, but it is not a trivial business, and anyone who approaches the problem as though it were a mere triviality is a fool.
I.e. from the security point of view, the RegEx parser is a firewall [and, in all likelihood, is the only firewall], hence anyone writing a RegEx parser has to assume that the user submitting the input is a blackhat, not a whitehat.
PS: And the problem undergoes manifold [if not infinite] complexification when you're dealing with languages [or "environments"] like HTML, Javascript, and XML, which can re-write themselves on the fly.
There are many routers out there running IOS that are used for Looking Glass purposes, so, yes, this is a problem I guess..
/0 does not mess up windows calc. They prepared for the error and it returns "Cannot divide by zero," then lets you continue on your merry way to further calculations.
To be fair, there IS a story here, which is that Cisco only just acknowledged this officially.
Service Provider types (the operators of routers whose successful attack would actually affect anyone in the real world) have been well aware of this. But as others have pointed out, if you don't trust your admins, and you're not running proper logging and a proper audit trail of admin sessions already, you've got bigger problems than this.
Everything I needed to know about life, I learnt from Blake's Seven
As it happens, I can divide by zero, but only when I try to figure out the inverse of the percentage of well-spent money from my tax dollars.
Or perhaps, the ratio of posts to informational-posts.
After all, Godwin needs revision - to paraphrase "A Beautiful Mind".
Buying Cisco equipment (typically - and through proper purchase channels) gives you access to TAC (Technical Assistance Center), worldwide support 24x7 for network emergencies and problems, as well as extensive troubleshooting support. When you buy Cisco these days, that is what you are mostly paying for. Try getting that level of assistance from Netgear, Linksys (ironically owned by Cisco), DLink, etc... You really can't - as they do not put that level of resource behind their products.
Really? So they can tell me how to get both ADSL modules to work? I've been trying to do that for a year, do you know whom I can contact? I tried their site's support section but they never replied (which is less than the support I've gotten from DLink or the OpenWRT people).
Send email from the afterlife! Write your e-will at Dead Man's Switch.
Quite a bit. If you look at a standard linksys router, it is a simple Broadcom (or Marvell) CPU+Network processor. Most companies use one of these chips in their consumer routers . They are cheap, and give the features most home users want. (Routing packets, simple firewall, wireless etc.) However, they are not as fast, nor are they flexible as this would add to the cost. (Actually, many other "enterprise" routers/switches use the same $5.00 chips) . Once you need a new feature.. you buy a new router.. Not a big deal for a $50.00 router).
In my experience the 2800 hardware is rock solid. I have managed over 200 hundred of these in the past and only had 1 failure. Caused by water.
So, other than having the huge support behind it, what makes a simple Cisco 2800 router ? They are specially designed and include specialized TCAM memory, encryption coprocessors, DSP's, and TDM switching. They can do IPS, Encryption, Wireless, Multi-protocol routing, Voice and video. They offer support for IPv6, BGP, Multicast, and others. They are modular and you have the capability to add almost any possible type of WAN port, (T1, DSL, DS3, EVDO, Edge), or all sorts of modules from a WAN Acceleration module to PoE enabled Switching, all the way to a VoiceMail system...
As for your network, I can guarantee that the OpenWRT is nowhere as feature rich as a Cisco router. You probably just never turned it on. I love using OpenWRT at home, but at the office, not a chance. Honestly, at the office, if you are just providing 5 people acccess to the internet over cable or DSL, and have no need for anything else other than moving packets, then OpenWRT is probably fine. If you are looking to provide features such as IP Voice, Advanced QoS, Network Admission Control, WAN Acceleration, Multi-point VPN tunnels, SSL VPN, or need a replacement in Kazakhstan within 4 hours, you probably need to go with the Cisco.
I've only interacted with Cisco support once, for replacing a PIX. Called them up, RMA was delivered shortly thereafter. Try calling them, if you do pay for support.
v4sw6PU$hw6ln6pr4F$ck 4/6$ma3+6u7LNS$w2m4l7U$i2e4+7en6a2X h
I'm in Greece, sadly a phonecall would cost more than the router. Maybe they have headquarters here, I'll look into that, thanks.
Send email from the afterlife! Write your e-will at Dead Man's Switch.
In case anyone cares, the reboot (or "reload" as cisco likes to call it) is caused by a stack overflow resulting from an uncaught recursive processing of specific combinations of regex options. The overflow must be input from the command line interface, after providing a valid username and password to login to the device. If you are being DOS'd by someone that has a valid login and password on your hardware, you have bigger issues that need dealing with before investigating firmware bugs in your router.
I work for the Department of Redundancy Department.
If a rogue has CLI access to your router, you have bigger issues. Proper filtering, TACACS and Logging, Out of Band Management makes this a non-issue.
The risk is almost the same as "reload" or the even more fun undocumented "test crash" commands.
Granted I do not think this vulnerability requires "enable" access, which does increase the risk. However, nobody should have any CLI to a router that you do not trust.
Can someone explain to me the difference between a $50 OpenWRT router and a $2k Cisco one?
Answer #1: The latter one can be installed and operated by mere mortals, or at least folks reasonably close to such.
Answer #2: The latter operates effectively within the scope of your existing monitoring and management processes while the former does not.
Answer #3: The latter is targeted at and marketed to companies (not individuals) where Answers 1 and 2 are much more important that the initial acquisition cost.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
The biggest thing I see between the expensive Cisco stuff and the cheap WRT stuff (once you flash the firmware, and thank god for the GPL, cause the original stuff sucked), is that the Cisco kit will support large gigabit networks, (And you can get older Cisco branded stuff at Linksys prices that doesn't if you shop the right channels).
Assuming you only need 100Mbit though (which is fine for lower tiered subnets), Well... there are three systems hooked up to my WRT54GL, and it's running at about 10% of capacity. I could probably squeeze a bit more out of it by turning the wireless of, but still wouldn't want to put more than 25 or so machines on it. And if those machines do anything fancy with the network, I might want to drop that even further.s-
Liberte, Egalite, Fraternite (TM)
At pretty much anything above the branch office level, however, there's a huge difference. The two biggies are the backplane, and the ability to support proper linecards with offload routing processors. When you have a fat high-end device in your network core with 8 16-way OC3 linecards, there's just no way the standard PC architecture can keep up. The PC architecture jus isn't designed to shift massive amounts of IO, twiddle bits on a zillion and one packets per second, then route them out a different interface.
If your cable runs look like this then you are not going to be using PC hardware, believe me.
Juniper are a good alternative to Cisco, though. There is now finally some competition.
Everything I needed to know about life, I learnt from Blake's Seven
That said, I'm on AT&T's route server right now and I can clearly see that it's been abused by the regex bug:
Note the uptime and line noting the reason for the last reboot.
So, in short, looking glasses aren't susceptible to this bug, at least none of the dozens LG projects I've seen are susceptible to this). However publicly accessible route servers that are IOS-based and not run on Juniper routers or Quagga may very well be susceptible if the admin hasn't secured the box.
Since I did a "show buffers all" on a 4948 and it reloaded the box. General rule I follow is that if you have to have root access to do something, it's not a vulnerability. This is just a TAC case/bug fix.
If you can telnet to the router's IP address and it doesn't block you (i.e. if there's any kind of remote administration), you get user exec mode. Good job.
Support my political activism on Patreon.
http://seclists.org/politech/2002/Dec/0004.html
Check that out, that's what your money buys you from Cisco.
Boston's Beth Israel Hospital went down due to a spanning tree protocol loop (caused by a network infrastructure that was improperly patched together). Cisco had a team on-site in under four hours working on the problem. They did a massive re-structuring of the major parts of the network in less than three days. They flew in two of their massive multi-switches to get the network working.
It's a cisco policy, I forget what it is called, but essentially if you need it they will spare no expense to get your company's network back up as soon as humanly possible.
Now, call up the guys running OpenWRT, and tell them your network is down. You know what they are going to say? Here are the forums and the docs that have all the info, good luck! If they are nice guys they'll even try to figure out what you need to fix it, but a problem like the Bethesda Israel network crash? Not going to be fixed over the phone.
This is nothing against OpenWRT, I think it's a great program and if I remember right it does most if not all of what a cisco router can do. However, you buy two things when you buy Cisco, you buy the horsepower for your application, and you buy reliability under ANY circumstance.
In otherwords, if you don't need that kind of reliability, why in god's name are you paying so much for a router?
This ISO vulnerability is really rather troubling also, since a lot of cisco routers out there are far from properly secured. So if all it takes is user mode, then there are quite a few systems that could be taken out by this. Of course if they were that insecure to begin with, it's really more of an option an attacker has to pick from to hose the router.
Security is mostly a superstition... Avoiding danger is no safer in the long run than outright exposure. - Helen Keller
Boston's Beth Israel Hospital went down due to a spanning tree protocol loop (caused by a network infrastructure that was improperly patched together).
;-)
And let the lesson for this be never to let spanning tree have to be used in the first place
Design layer 2 networks such that ports are always in a forwarding state, i.e. a loop free physical topology.
"Nature doesn't care how smart you are. You can still be wrong." - Richard Feynman
I agree layer3 is an easier setup for any failover or whatever else reason you might want more links.
But spanning tree can still be usefull for when someone creates a loop by accident.
But then again, it may stay undetected.
So it depends on what your prefereences are.
New things are always on the horizon