-----BEGIN PGP SIGNED MESSAGE-----
Interim Field Notice:
7xx Router Password Buffer Overflow
December 15, 1997, 17:00 US/Pacific, Revision 1
Summary
- -----
Some Cisco 7xx routers can be crashed by connecting with TELNET and typing
very long password strings. There exists a possibility that this bug could
be exploited to take complete control of the router, rather than simply
crashing it.
Who Is Affected
- -------------
All Cisco 7xx routers running IOS/700 software version 4.1(1), 4.1(2), or
4.1 interim releases earlier than 4.1(2.1) are affected. Systems running
releases earlier than 4.1 are not affected. In order to exploit the
vulnerability, an attacker must have access to the password prompt. This
means that the attacker must be able to TELNET to the target router, or to
gain access to its console port.
Impact
- ----
This vulnerability allows attackers to force 7xx routers to reboot, denying
service to legitimate users during the reboot period, and possibly causing
excessive "call flapping" as routers shut down and restart.
It is possible that including the right data at the right place in the
too-long password string could enable an attacker to take complete control
of the router. Cisco has not fully evaluated the actual feasibility of this
attack. A person who succeeded in such an attack would be able to
reconfigure the router or modify its functionality, theoretically in any way
at all.
It is also possible that certain data strings, while not permitting total
control of the router, could cause it to hang indefinitely rather than
crashing, or to malfunction in other ways. Cisco has not fully evaluated the
possible effects of all possible data strings.
Details
- -----
This vulnerability has been assigned bug ID CSCdj66458.
Insufficient bounds checking on the data buffer used for password input
allows the incoming password to exceed the buffer size, overwriting the
contents of memory beyond the end of the buffer. When the system tries to
use the now-incorrect data in that memory, unpredictable results occur. If
the data are randomly chosen, this unpredictable behavior can be expected to
result in the detection of errors, such as accesses to illegal addresses,
which result in system crashes. It might be possible to craft a data string
that, instead of creating detectable errors, caused particular system
behavior desired by the attacker.
Affected Cisco IOS/700 Software Versions
- --------------------------------------
This vulnerability affects systems running IOS/700 version 4.1 releases,
including 4.1(1), 4.1(2), and 4.1 interim releases earlier than 4.1(2.1).
IOS/700 releases other than 4.1 are not affected.
Planned Software Fixes
- --------------------
Cisco is presently testing a software fix for this problem. We expect the
fix to be ready for customer use by December 24, 1997. Because of the
exigencies of the software development and testing process, we cannot
guarantee this date. Please check the copy of this notice on Cisco's Web
page for updated information about the status of the fixed release. When the
fixed software is available, this page will include instructions for
obtaining it. Cisco will be making the fixed software available to all
IOS/700 customers who are presently running 4.1 software, regardless of
contract status.
Workaround
- --------
The vulnerability may be avoided by controlling access to the system console
port, and by restricting access to the TELNET facility to trusted hosts.
TELNET access may be restricted either by using filters on firewalls or
surrounding routers, or by using filters on the 7xx router itself. To
restrict access to the TELNET service on a 7xx router running 4.1(x)
software to a single trusted management host, use the command
set ip filter tcp in source = not trusted-ip-address destination = 7xx-address:23 block
The command should be applied in every profile that may be active when the
router is connected to a potentially hostile network.
Exploitation and Public Announcements
- -----------------------------------
Cisco has had no known reports of malicious exploitation of this
vulnerability.
This vulnerability has been discussed on the "bugtraq@netspace.org" mailing
list, and is therefore certain to be widely known in the cracker community.
The first public announcement of this vulnerability of which Cisco is aware
was on December 11, 1997.
The vulnerability can be exploited to crash systems with no special tools or
knowledge; no exploitation program as such is required.
Assuming that it is possible to exploit the vulnerability to take total
control of the system, an exploitation program would be needed in order to
do so. A person seeking to develop such an exploitation program would need
to be a competent assembly language programmer. She would also need detailed
knowledge of the internal workings of the IOS/700 software and/or the 7xx
router hardware. Such knowledge has not been made public by Cisco, but could
be obtained by reverse engineering or by theft of trade secrets from Cisco.
Status of This Notice
- -------------------
This is an interim field notice. Because Cisco customers are in immediate
need of timely information about the issues addressed, this notice has been
issued with less review and less fact-checking than is customary in
corporate public statements. Although Cisco believes all statements in this
notice to be correct, readers must understand that the potential for error
does exist. Errors may include both factual errors and errors of editing,
formatting, and emphasis. Readers of this notice rely on the information
herein at their own risk.
This notice will be updated as more information becomes available. The
status of this notice will be changed from interim to final when complete,
fully verified information is available.
Distribution
- ----------
The initial version of this notice is being sent to the following Internet
mailing lists and newsgroups:
* cisco@spot.colorado.edu
* comp.dcom.sys.cisco
* bugtraq@netspace.org
* first-teams@first.org (includes CERT/CC)
Future versions of this notice will be posted on Cisco's Web site, but will
not be actively announced on mailing lists or newsgroups. Users concerned
about this problem are encouraged to check the Web site for updates.
This notice will be posted in the "Field Notices" section of Cisco's
Worldwide Web site, which can be found under "Technical Tips" in the
"Software and Support" section. The URL is
http://www.cisco.com/warp/public/770/pwbuf-pub.shtml. The copy on the
Worldwide Web will be updated as appropriate.
Revision History
- --------------
Revision 1, 17:00, Initial version.
15-DEC-1997
Cisco Security Procedures
- -----------------------
Please report security issues with Cisco products, and/or sensitive security
intrusion emergencies involving Cisco products, to security-alert@cisco.com.
Reports may be encrypted using PGP; public RSA and DSS keys for
security-alert@cisco.com are on the public PGP keyservers.
The alias security-alert@cisco.com is used only for reports incoming to
Cisco. Mail sent to security-alert@cisco.com goes only to a very small group
of users within Cisco. Neither outside users nor unauthorized Cisco
employees may subscribe to security-alert@cisco.com. We will shortly be
creating a security announcement mailing list for outgoing information. When
that list is created, an announcement will be sent to appropriate Internet
forums.
Please do not use security-alert@cisco.com for configuration questions, for
security intrusions that you do not consider to be sensitive emergencies, or
for general, non-security-related support requests. We do not have the
capacity to handle such requests through this channel, and will have to
refer them to Cisco's Technical Assistance Center, delaying response to your
questions. We advise contacting the Technical Assistance Center directly
with this type of question.
=-=
From Laslo@CPOL.COM Thu Dec 11 13:27:43 1997
From: Laslo Orto
X-Sender: Laslo@mail.cpol.com
To: BUGTRAQ@NETSPACE.ORG
Date: Thu, 11 Dec 1997 01:11:13 -0500
: Laslo@mail.cpol.com
Subject: cisco 76x buffer overflow
I dont know of anybody ever posting anything on this sbuject, so i'll go
ahed. I found a buffer overflow in the cisco 76x
series router. The bug exists only in the 4 users limit software, i couldnt
reproduce it with the unlimited version.
When i reported the bug to cisco i promised them that i'll post this info to
public if they dont fix it withing a week.
It was over a month ago, and i was never notified of any fix so i'm asuming
they didnt make any fix. I also cant find any
mentioning of this bug on their web site by searching for the bug id.
The exploit is prety simple:
telnet cisco762.domain.com
Trying 1.2.3.4...
Connected to 1.2.3.4.
Escape character is '^]'.
Enter Password:Enter a
veryyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy
yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy
yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy
yyyyyyyyyyyyyyyyyyyyyyyyyyyy long string here
and watch the prety lights go on as the cisco reboots, or imagine your
victim tearing his hair out.
|