Cisco Confirms Regex Flaw in IOS

gattaca writes "Cisco has announced a confirmation of an unpatched denial of service vulnerability in Cisco IOS. From the NetPro Forum post: 'I have just discovered a regular expression that crashes the router. I suspect the error is because of division by zero. Since I work for the Enterprise, I do not have direct access to TAC. Please somebody report this to Cisco. I have tested it on ranges of routers (2611, 2821, 2851, 7206) and IOSes (12.0-12.4). All routers crashed with some type of BUS ERROR. Command can be issued in user mode, therefore I think it can be considered as vulnerability to potentially cause DOS.'" Of course, the command has to be entered in user mode, so while potentially a vulnerability, chances are your local IOS-based router won't be DoSed via the bug any time soon.

Comments

Re:does it could as denial of service

[blantonl]

It only if works you authenticated are router to the.

A bigger IOS flaw discovered

[packetmon]

A bigger vulnerability has been discovered just now as well...

r8#sh ver | in IOS
IOS (tm) C2600 Software (C2600-IO3-M), Version 12.2(15)T2, RELEASE SOFTWARE (fc2)
r8#reload
Proceed with reload? [confirm]

Seems like anyone with admin access can reload your router.

IOS (tm) 4500 Software (C4500-A3JK9S-M), Version 12.2(40a), RELEASE SOFTWARE (fc1)
frSwitch#reload
Proceed with reload? [confirm]

Confirmed on multiple routers as well! OMFG. On another note, anyone with local access to the router can power down the router causing a massive denial of service. Our admins here at GoodyTwoShoesNetworking.com are placing epoxy across all power buttons and cables to prevent this

The Enterprise

[AntEater]

"Since I work for the Enterprise, I do not have direct access to TAC. "

Yes, Capt. Kirk can be very protective of the TAC.

Re:The Enterprise

[Anonymous Coward]

I always wonder why a company like Cisco, of which you would expect that it puts quality at a top priority, does not accept bug reports from owners of their devices who have not paid extra for a support contract.
Even when they don't want to guarantee response times or resolution times, at the very least they could register the problems their customers have discovered.

Old news (to everyone but Cisco)

[OriginalArlen]

This was widely publicized (amongst the loose communities of Cisco users, anyway) back around the time the original post was made. Hey, that would have been... 18th August! :)

To be fair, there IS a story here, which is that Cisco only just acknowledged this officially.

Service Provider types (the operators of routers whose successful attack would actually affect anyone in the real world) have been well aware of this. But as others have pointed out, if you don't trust your admins, and you're not running proper logging and a proper audit trail of admin sessions already, you've got bigger problems than this.

Re:Not a surprise

[Algorithmnast]

Dividing by zero screws everything up. Even Windows Calc, one of the most advanced pieces of software on the planet, can't do it.

As it happens, I can divide by zero, but only when I try to figure out the inverse of the percentage of well-spent money from my tax dollars.

Or perhaps, the ratio of posts to informational-posts.

After all, Godwin needs revision - to paraphrase "A Beautiful Mind".

Re:A question

[OriginalArlen]

At the low end, there's not a great deal of difference beyond the value of the brand (which is non-zero: how many replies do job ads for "network engineer, min 4 years experience with Linux based routers" get vs. "cisco-based routers"? )

At pretty much anything above the branch office level, however, there's a huge difference. The two biggies are the backplane, and the ability to support proper linecards with offload routing processors. When you have a fat high-end device in your network core with 8 16-way OC3 linecards, there's just no way the standard PC architecture can keep up. The PC architecture jus isn't designed to shift massive amounts of IO, twiddle bits on a zillion and one packets per second, then route them out a different interface.

If your cable runs look like this then you are not going to be using PC hardware, believe me.

Juniper are a good alternative to Cisco, though. There is now finally some competition.