Slashdot Mirror
Cisco Confirms Regex Flaw in IOS
gattaca writes "Cisco has announced a confirmation of an unpatched denial of service vulnerability in Cisco IOS. From the NetPro Forum post: 'I have just discovered a regular expression that crashes the router. I suspect the error is because of division by zero. Since I work for the Enterprise, I do not have direct access to TAC. Please somebody report this to Cisco. I have tested it on ranges of routers (2611, 2821, 2851, 7206) and IOSes (12.0-12.4). All routers crashed with some type of BUS ERROR.
Command can be issued in user mode, therefore I think it can be considered as vulnerability to potentially cause DOS.'" Of course, the command has to be entered in user mode, so while potentially a vulnerability, chances are your local IOS-based router won't be DoSed via the bug any time soon.
if your own people have to do it?
FTA: "I have just discovered a regular expression that crashes the router. I suspect the error is because of division by zero."
Reminds me of:
Patient: "My arm hurts when I do this." <wiggles arm>
Doctor: "Then don't do that."
The solution is obvious: don't use that regex/divide by zero. Duhhhh. Problem solved. Thank you, come again.
Infiltrated dot Net
"Since I work for the Enterprise, I do not have direct access to TAC. "
Yes, Capt. Kirk can be very protective of the TAC.
Alex, I'll take keybindings not used by Emacs for $400....
Writing code that can parse for any given syntax is, well, pretty much as difficult as writing a parsing front-end to a compiler.
I.e. it is not trivial and it is fraught with danger.
Any time you allow the user to submit arbitrary, un-screened, un-filtered data, you're just asking for trouble.
Of course, I guess you could argue that the job of a RegEx parser is precisely to do the screening & the filtering for you, but it is not a trivial business, and anyone who approaches the problem as though it were a mere triviality is a fool.
I.e. from the security point of view, the RegEx parser is a firewall [and, in all likelihood, is the only firewall], hence anyone writing a RegEx parser has to assume that the user submitting the input is a blackhat, not a whitehat.
PS: And the problem undergoes manifold [if not infinite] complexification when you're dealing with languages [or "environments"] like HTML, Javascript, and XML, which can re-write themselves on the fly.
To be fair, there IS a story here, which is that Cisco only just acknowledged this officially.
Service Provider types (the operators of routers whose successful attack would actually affect anyone in the real world) have been well aware of this. But as others have pointed out, if you don't trust your admins, and you're not running proper logging and a proper audit trail of admin sessions already, you've got bigger problems than this.
Everything I needed to know about life, I learnt from Blake's Seven
As it happens, I can divide by zero, but only when I try to figure out the inverse of the percentage of well-spent money from my tax dollars.
Or perhaps, the ratio of posts to informational-posts.
After all, Godwin needs revision - to paraphrase "A Beautiful Mind".
Buying Cisco equipment (typically - and through proper purchase channels) gives you access to TAC (Technical Assistance Center), worldwide support 24x7 for network emergencies and problems, as well as extensive troubleshooting support. When you buy Cisco these days, that is what you are mostly paying for. Try getting that level of assistance from Netgear, Linksys (ironically owned by Cisco), DLink, etc... You really can't - as they do not put that level of resource behind their products.
The biggest thing I see between the expensive Cisco stuff and the cheap WRT stuff (once you flash the firmware, and thank god for the GPL, cause the original stuff sucked), is that the Cisco kit will support large gigabit networks, (And you can get older Cisco branded stuff at Linksys prices that doesn't if you shop the right channels).
Assuming you only need 100Mbit though (which is fine for lower tiered subnets), Well... there are three systems hooked up to my WRT54GL, and it's running at about 10% of capacity. I could probably squeeze a bit more out of it by turning the wireless of, but still wouldn't want to put more than 25 or so machines on it. And if those machines do anything fancy with the network, I might want to drop that even further.s-
Liberte, Egalite, Fraternite (TM)
At pretty much anything above the branch office level, however, there's a huge difference. The two biggies are the backplane, and the ability to support proper linecards with offload routing processors. When you have a fat high-end device in your network core with 8 16-way OC3 linecards, there's just no way the standard PC architecture can keep up. The PC architecture jus isn't designed to shift massive amounts of IO, twiddle bits on a zillion and one packets per second, then route them out a different interface.
If your cable runs look like this then you are not going to be using PC hardware, believe me.
Juniper are a good alternative to Cisco, though. There is now finally some competition.
Everything I needed to know about life, I learnt from Blake's Seven
That said, I'm on AT&T's route server right now and I can clearly see that it's been abused by the regex bug:
Note the uptime and line noting the reason for the last reboot.
So, in short, looking glasses aren't susceptible to this bug, at least none of the dozens LG projects I've seen are susceptible to this). However publicly accessible route servers that are IOS-based and not run on Juniper routers or Quagga may very well be susceptible if the admin hasn't secured the box.
Since I did a "show buffers all" on a 4948 and it reloaded the box. General rule I follow is that if you have to have root access to do something, it's not a vulnerability. This is just a TAC case/bug fix.