[nsp] Cisco Security Advisory: Cisco VPN 3000 Concentrator Multiple Vulnerabilities
Cisco Systems Product Security Incident Response Team
psirt@cisco.com
Tue, 3 Sep 2002 08:00:00 -0700 (UTC)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Cisco VPN 3000 Concentrator Multiple Vulnerabilities
Revision 1.0
For Public Release 2002 September 03 at 1500 UTC
----------------------------------------------------------------------
Contents
Summary
Affected Products
Details
Impact
Software Versions and Fixes
Obtaining Fixed Software
Workarounds
Exploitation and Public Announcements
Status of This Notice
Distribution
Revision History
Cisco Security Procedures
----------------------------------------------------------------------
Summary
The Cisco VPN 3000 series concentrators are a family of purpose-built,
remote access Virtual Private Network (VPN) platforms for data encryption
and authentication.
This advisory documents multiple vulnerabilities for the Cisco VPN 3000
series concentrators and Cisco VPN 3002 Hardware Client. These
vulnerabilities are documented as Cisco bug ID's CSCdt56514, CSCdu15622,
CSCdu35577, CSCdu82823, CSCdv66718, CSCdv88230, CSCdw22408, CSCdw50657,
CSCdx07754, CSCdx24622, CSCdx24632, CSCdx39981, CSCdx54675 and CSCdy38035.
Upgrading to the latest version of code for the Cisco VPN 3000 series
concentrators and Cisco VPN 3002 Hardware Client, version 3.5.5 or 3.6.1,
would protect against all of these documented vulnerabilities.
This advisory will be posted at
http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml.
Affected Products
The Cisco VPN 3000 series concentrators are affected by these
vulnerabilities. This series includes models 3005, 3015, 3030, 3060, 3080
and the Cisco VPN 3002 Hardware Client.
+-------------------------------------------------+
| DDTS - Description | Affected Releases |
|-----------------------------+-------------------|
| CSCdt56514 - PPTP, IPSEC | * 3.6(Rel) |
| internal authentication | * 3.5(Rel) to |
| login vulnerability | 3.5.4 |
| | * earlier than |
| | 3.1.2 |
| | * earlier than |
| | 3.0.3(B) |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdu15622 - HTML parser | * earlier than |
| processing vulnerability | 3.0.3(B) |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdu35577 - Concentrator | * earlier than |
| gives out too much | 3.5.4 |
| information in application | * 3.1.x |
| layer banners | * 3.0.x |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdu82823 - BSD sourced | * earlier than |
| telnetd vulnerability | 3.0.4 |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdv66718 - Windows PPTP | * earlier than |
| client vulnerability | 2.5.2(F) |
|-----------------------------+-------------------|
| CSCdv88230, CSCdw22408 - | * earlier than |
| User passwords visible with | 3.5.1 |
| HTML view source | * earlier than |
| vulnerability | 3.1.4 |
| | * 3.0.x |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdw50657 - Certificate | * earlier than |
| passwords visible with HTML | 3.5.2 |
| view source vulnerability | * 3.1.x |
| | * 3.0.x |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdx07754 - XML public | * earlier than |
| rule vulnerability | 3.5.3 |
| | * 3.1.x |
| | * 3.0.x |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdx24622 - HTML pages | * earlier than |
| access vulnerability | 3.5.3 |
| | * 3.1.x |
| | * 3.0.x |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdx24632 - HTML login | * earlier than |
| processing vulnerability | 3.5.3 |
| | * 3.1.x |
| | * 3.0.x |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdx39981 - VPN client | * 3.6(Rel) |
| authentication | * earlier than |
| vulnerability | 3.5.5 |
| | * 3.1.x |
| | * 3.0.x |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdx54675 - LAN-to-LAN | * earlier than |
| IPSEC tunnel vulnerability | 3.5.4 |
| | * 3.1.x |
| | * 3.0.x |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdy38035 - ISAKMP packet | * 3.6(Rel) |
| processing vulnerability | * earlier than |
| | 3.5.5 |
| | * 3.1.x |
| | * 3.0.x |
| | * 2.x.x |
+-------------------------------------------------+
These vulnerabilities do not affect the VPN Client software nor the Cisco
VPN 5000 series concentrators. No other Cisco product is known to be
affected by these vulnerabilities.
To determine if a Cisco VPN 3000 series concentrator is running affected
software, check the software revision via the web interface or the console
menu.
Details
+-------------------------------------------------+
| DDTS - | Details |
| Description | |
|------------------+------------------------------|
| CSCdt56514 - | If a Cisco VPN 3000 series |
| PPTP, IPSEC | concentrator is set up for |
| internal | internal authentication with |
| authentication | only group accounts |
| login | configured and no user |
| vulnerability | accounts configured, then a |
| | VPN client logging in using |
| | PPTP or IPSEC user |
| | authentication succeeds by |
| | using a group name/password |
| | as login credentials. |
| | For VPN client connections |
| | using IPSEC user |
| | authentication, the Cisco |
| | VPN series concentrator will |
| | not allow the VPN client to |
| | use the same group |
| | name/password as what is |
| | configured in the VPN |
| | client's connection |
| | properties, but if another |
| | group account exists on the |
| | concentrator, then using its |
| | group name/password the VPN |
| | client can authenticate to |
| | the VPN concentrator. |
| | The Cisco VPN 3002 Hardware |
| | Client does not support PPTP |
| | or incoming connections and |
| | therefore is not vulnerable |
| | to this problem. |
|------------------+------------------------------|
| CSCdu15622 - | Very long URL requests to |
| HTML parser | the HTML interface cause the |
| processing | VPN 3000 series concentrator |
| vulnerability | to stop responding. The CPU |
| | on the Cisco VPN |
| | concentrator jumps to 100%. |
| | The IP stack of the VPN |
| | concentrator stops |
| | responding. |
| | The VPN concentrator |
| | recovers approximately five |
| | minutes after the DoS attack |
| | is stopped. |
|------------------+------------------------------|
| CSCdu35577 - | The Cisco VPN 3000 series |
| Concentrator | concentrators give out too |
| gives out too | much information in |
| much information | application layer banners. |
| in application | The SSH banner gives out |
| layer banners | information about the device |
| | apart from the SSH version |
| | numbers. The FTP banner |
| | gives information about the |
| | device and the local time. |
| | An incorrect HTTP page |
| | request gives out |
| | information about the |
| | device, the name of the |
| | person who compiled the |
| | software and the time of |
| | compilation. |
|------------------+------------------------------|
| CSCdu82823 - BSD | Cisco VPN 3000 series |
| sourced telnetd | concentrators run telnetd |
| vulnerability | daemon code derived from the |
| | BSD source and are |
| | vulnerable to a buffer |
| | overflow in the telnet |
| | option handling, which can |
| | cause the telnet daemon to |
| | crash and result in a VPN |
| | concentrator reload. This |
| | vulnerability is also |
| | documented as CERT Advisory |
| | CA-2001-21. |
| | Telnet is not permitted on |
| | the public interface of the |
| | VPN concentrator in the |
| | default configuration and is |
| | never permitted on the |
| | public interface of the VPN |
| | 3002 Hardware Client. |
|------------------+------------------------------|
| CSCdv66718 - | Windows native PPTP clients |
| Windows PPTP | connecting with the No |
| client | Encryption option set can |
| vulnerability | cause the Cisco VPN 3000 |
| | series concentrator, with |
| | encryption set, to reload. |
|------------------+------------------------------|
| CSCdv88230, | On password containing HTML |
| CSCdw22408 - | pages for the Cisco VPN 3000 |
| User passwords | series concentrator it is |
| visible with | possible for restricted |
| HTML view source | access administrative users |
| vulnerability | to observe the password in |
| | clear text upon viewing the |
| | source of the web page |
| | without having the |
| | appropriate level of |
| | administrative access. |
|------------------+------------------------------|
| CSCdw50657 - | On the Certificate |
| Certificate | Management HTML pages for |
| passwords | the Cisco VPN 3000 series |
| visible with | concentrator it is possible |
| HTML view source | for administrative users to |
| vulnerability | observe the unencrypted |
| | certificate password in |
| | clear text upon viewing the |
| | source of the web page. |
|------------------+------------------------------|
| CSCdx07754 - XML | When a Cisco VPN 3000 series |
| public rule | concentrator has the XML |
| vulnerability | filter configuration enabled |
| | on its public interface, the |
| | configuration adds the rule |
| | "HTTPS on Public Inbound |
| | (XML-Auto)(forward/in)" to |
| | the public filter and sets |
| | the value for the protocol |
| | incorrectly to "ANY" and the |
| | value for the destination |
| | port to "443". The VPN |
| | concentrator checks the |
| | destination port field value |
| | only when the protocol is |
| | set to TCP or UDP. So |
| | enabling this filter |
| | configuration effectively |
| | allows any protocol on any |
| | port through the VPN |
| | Concentrator. |
|------------------+------------------------------|
| CSCdx24622 - | Users can access a few Cisco |
| HTML pages | VPN 3000 series concentrator |
| access | HTML pages containing |
| vulnerability | limited information without |
| | proper authentication. |
|------------------+------------------------------|
| CSCdx24632 - | It is possible to cause the |
| HTML login | Cisco VPN 3000 series |
| processing | concentrator to reload by |
| vulnerability | modifying an HTML file and |
| | posting very large strings |
| | as the username/password |
| | while accessing the HTML |
| | interface on the VPN |
| | concentrator. |
|------------------+------------------------------|
| CSCdx39981 - VPN | When using a VPN client it |
| client | is possible to cause the |
| authentication | Cisco VPN 3000 series |
| vulnerability | concentrator to reload by |
| | responding with a very large |
| | string for the username |
| | prompt. |
|------------------+------------------------------|
| CSCdx54675 - | The Cisco VPN 3000 series |
| LAN-to-LAN IPSEC | concentrator does not drop |
| tunnel | an incoming LAN-to-LAN |
| vulnerability | connection even when it |
| | already has a security |
| | association for the same |
| | remote network with another |
| | device. Instead it |
| | disconnects the previously |
| | established connection and |
| | establishes a connection |
| | with the new device. The VPN |
| | concentrator also does not |
| | verify if the data coming |
| | across a LAN-to-LAN |
| | connection is being sourced |
| | from the correct network. |
|------------------+------------------------------|
| CSCdy38035 - | Malformed or very large |
| ISAKMP packet | ISAKMP packets can cause |
| processing | device reloads in four |
| vulnerability | instances: |
| | * Upon receipt of a |
| | malformed ISAKMP packet |
| | * Upon having debug turned |
| | on during the receipt of |
| | various malformed |
| | packets |
| | * Upon receiving a very |
| | large number of payloads |
| | in an ISAKMP packet |
| | * Upon having debug turned |
| | on while receiving large |
| | ISAKMP packets. |
+-------------------------------------------------+
These vulnerabilities are documented as Cisco bug ID's CSCdt56514,
CSCdu15622, CSCdu35577, CSCdu82823, CSCdv66718, CSCdv88230, CSCdw22408,
CSCdw50657, CSCdx07754, CSCdx24622, CSCdx24632, CSCdx39981, CSCdx54675 and
CSCdy38035, which require a CCO account to view and can be viewed after
2002 September 4 at 1500 UTC.
Impact
+-------------------------------------------------+
| DDTS - Description | Impact |
|------------------------+------------------------|
| CSCdt56514 - PPTP, | Unintended access to |
| IPSEC internal | the network serviced |
| authentication login | by the VPN 3000 series |
| vulnerability | concentrator. |
|------------------------+------------------------|
| CSCdu15622 - HTML | This vulnerability can |
| parser processing | be exploited to |
| vulnerability | initiate a DOS attack. |
|------------------------+------------------------|
| CSCdu35577 - | The extra information |
| Concentrator gives out | given out could help |
| too much information | an attacker plan his |
| in application layer | attacks. |
| banners | |
|------------------------+------------------------|
| CSCdu82823 - BSD | This vulnerability can |
| sourced telnetd | be exploited to |
| vulnerability | initiate a DOS attack. |
|------------------------+------------------------|
| CSCdv66718 - Windows | This vulnerability can |
| PPTP client | be exploited to |
| vulnerability | initiate a DOS attack. |
|------------------------+------------------------|
| CSCdv88230, CSCdw22408 | Unintended disclosure |
| - User passwords | of passwords on non |
| visible with HTML view | administrative user |
| source vulnerability | accessed HTML pages. |
|------------------------+------------------------|
| CSCdw50657 - | Unintended disclosure |
| Certificate passwords | of passwords on an |
| visible with HTML view | administrative user |
| source vulnerability | accessed HTML page. |
|------------------------+------------------------|
| CSCdx07754 - XML | Unintended access to |
| public rule | the network serviced |
| vulnerability | by the Cisco VPN 3000 |
| | series concentrator. |
|------------------------+------------------------|
| CSCdx24622 - HTML | Unintended access to |
| pages access | generic content on a |
| vulnerability | few HTML pages. |
|------------------------+------------------------|
| CSCdx24632 - HTML | This vulnerability can |
| login processing | be exploited to |
| vulnerability | initiate a DOS attack. |
|------------------------+------------------------|
| CSCdx39981 - VPN | This vulnerability can |
| client authentication | be exploited to |
| vulnerability | initiate a DOS attack. |
|------------------------+------------------------|
| CSCdx54675 - | This vulnerability can |
| LAN-to-LAN IPSEC | be exploited to |
| tunnel vulnerability | initiate a DOS attack. |
|------------------------+------------------------|
| CSCdy38035 - ISAKMP | These vulnerabilities |
| packet processing | can be exploited to |
| vulnerability | initiate DOS attacks. |
+-------------------------------------------------+
Software Versions and Fixes
+-------------------------------------------------+
| DDTS - Description | Fixed Releases |
|---------------------------+---------------------|
| CSCdt56514 - PPTP, IPSEC | * 3.6.1 or later |
| internal authentication | * 3.5.5 or later |
| login vulnerability | * 3.1.2 or later |
| | for 3.1.x |
| | releases |
| | * 3.0.3(B) or |
| | later for 3.0.x |
| | releases |
|---------------------------+---------------------|
| CSCdu15622 - HTML parser | * 3.6(Rel) or |
| processing vulnerability | later |
| | * 3.5(Rel) or |
| | later |
| | * 3.1(Rel) or |
| | later |
| | * 3.0.3(B) or |
| | later |
|---------------------------+---------------------|
| CSCdu35577 - Concentrator | * 3.6(Rel) or |
| gives out too much | later |
| information in | * 3.5.4 or later |
| application layer banners | |
|---------------------------+---------------------|
| CSCdu82823 - BSD sourced | * 3.6(Rel) or |
| telnetd vulnerability | later |
| | * 3.5(Rel) or |
| | later |
| | * 3.1(Rel) or |
| | later |
| | * 3.0.4 or later |
|---------------------------+---------------------|
| CSCdv66718 - Windows PPTP | * 3.6(Rel) or |
| client vulnerability | later |
| | * 3.5(Rel) or |
| | later |
| | * 3.1(Rel) or |
| | later |
| | * 3.0(Rel) or |
| | later |
| | * 2.5.2(F) or |
| | later |
|---------------------------+---------------------|
| CSCdv88230, CSCdw22408 - | * 3.6(Rel) or |
| User passwords visible | later |
| with HTML view source | * 3.5.1 or later |
| vulnerability | * 3.1.4 or later |
|---------------------------+---------------------|
| CSCdw50657 - Certificate | * 3.6(Rel) or |
| passwords visible with | later |
| HTML view source | * 3.5.2 or later |
| vulnerability | |
|---------------------------+---------------------|
| CSCdx07754 - XML public | * 3.6(Rel) or |
| rule vulnerability | later |
| | * 3.5.3 or later |
|---------------------------+---------------------|
| CSCdx24622 - HTML pages | * 3.6(Rel) or |
| access vulnerability | later |
| | * 3.5.3 or later |
|---------------------------+---------------------|
| CSCdx24632 - HTML login | * 3.6(Rel) or |
| processing vulnerability | later |
| | * 3.5.3 or later |
|---------------------------+---------------------|
| CSCdx39981 - VPN client | * 3.6.1 or later |
| authentication | * 3.5.5 or later |
| vulnerability | |
|---------------------------+---------------------|
| CSCdx54675 - LAN-to-LAN | * 3.6(Rel) or |
| IPSEC tunnel | later |
| vulnerability | * 3.5.4 or later |
|---------------------------+---------------------|
| CSCdy38035 - ISAKMP | * 3.6.1 or later |
| packet processing | * 3.5.5 or later |
| vulnerability | |
+-------------------------------------------------+
The procedure to upgrade to the fixed software version is detailed at
http://www.cisco.com/univercd/cc/td/doc/product/vpn/vpn3000/vpn3kco/vcoug/usr_3_0/admin.htm#xtocid2259937.
Obtaining Fixed Software
Cisco is offering free software upgrades to address these vulnerabilities
for all affected customers. Customers may only install and expect support
for the feature sets they have purchased.
Customers with service contracts should contact their regular update
channels to obtain the free software upgrade identified via this advisory.
For most customers with service contracts, this means that upgrades should
be obtained through the Software Center on Cisco's worldwide website at
http://www.cisco.com/pcgi-bin/tablebuild.pl/vpn3000-3des. To access this
link you must be a registered user and you must be logged in.
Customers whose Cisco products are provided or maintained through a prior
or existing agreement with third-party support organizations such as Cisco
Partners, authorized resellers, or service providers should contact that
support organization for assistance with obtaining the free software
upgrade(s).
Customers who purchased directly from Cisco but who do not hold a Cisco
service contract, and customers who purchase through third party vendors
but are unsuccessful at obtaining fixed software through their point of
sale, should obtain fixed software by contacting the Cisco Technical
Assistance Center (TAC) using the contact information listed below. In
these cases, customers are entitled to obtain an upgrade to a later
version of the same release or as indicated by the applicable corrected
software version in the Software Versions and Fixes section (noted above).
Cisco TAC contacts are as follows:
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for
additional TAC contact information, including special localized telephone
numbers and instructions and e-mail addresses for use in various
languages.
Please have your product serial number available and give the URL of this
advisory as evidence of your entitlement to a free upgrade.
Please do not contact either "psirt@cisco.com" or
"security-alert@cisco.com" for software upgrades.
Workarounds
+-------------------------------------------------+
| DDTS - Description | Workarounds / |
| | Mitigation techniques |
|------------------------+------------------------|
| CSCdt56514 - PPTP, | If possible use |
| IPSEC internal | external |
| authentication login | authentication like |
| vulnerability | TACACS+ or RADIUS. |
|------------------------+------------------------|
| CSCdu15622 - HTML | Restrict access to the |
| parser processing | HTML interface such |
| vulnerability | that connections are |
| | permitted only from |
| | trusted sources. |
|------------------------+------------------------|
| CSCdu35577 - | There is no |
| Concentrator gives out | workaround. |
| too much information | |
| in application layer | |
| banners | |
|------------------------+------------------------|
| CSCdu82823 - BSD | Restrict access to the |
| sourced telnetd | telnet interface such |
| vulnerability | that connections are |
| | permitted only from |
| | trusted sources. |
|------------------------+------------------------|
| CSCdv66718 - Windows | If possible configure |
| PPTP client | the VPN 3000 series |
| vulnerability | concentrator for IPSEC |
| | support only. |
|------------------------+------------------------|
| CSCdv88230, CSCdw22408 | Restrict access to the |
| - User passwords | HTML interface such |
| visible with HTML view | that connections are |
| source vulnerability | permitted only from |
| | trusted sources. |
|------------------------+------------------------|
| CSCdw50657 - | Restrict access to the |
| Certificate passwords | HTML interface such |
| visible with HTML view | that connections are |
| source vulnerability | permitted only from |
| | trusted sources. |
|------------------------+------------------------|
| CSCdx07754 - XML | Remove any XML filter |
| public rule | on the public |
| vulnerability | interface. |
|------------------------+------------------------|
| CSCdx24622 - HTML | Restrict access to the |
| pages access | HTML interface such |
| vulnerability | that connections are |
| | permitted only from |
| | trusted sources. |
|------------------------+------------------------|
| CSCdx24632 - HTML | Restrict access to the |
| login processing | HTML interface such |
| vulnerability | that connections are |
| | permitted only from |
| | trusted sources. |
|------------------------+------------------------|
| CSCdx39981 - VPN | There is no |
| client authentication | workaround. |
| vulnerability | |
|------------------------+------------------------|
| CSCdx54675 - | There is no |
| LAN-to-LAN IPSEC | workaround. |
| tunnel vulnerability | |
|------------------------+------------------------|
| CSCdy38035 - ISAKMP | There is no |
| packet processing | workaround. |
| vulnerability | |
+-------------------------------------------------+
The Cisco PSIRT recommends that affected users upgrade to a fixed software
version of code.
Exploitation and Public Announcements
The Cisco PSIRT is not aware of any public announcements or malicious use
of the vulnerability described in this advisory.
These vulnerabilities were reported to PSIRT by internal development
testing and customers. The invalid ISAKMP packet length vulnerability
addressed by CSCdy38035 was reported to the PSIRT by Phenoelit. The
vulnerabilities addressed by CSCdx24622 and CSCdx24632 were reported to
Cisco by Vigilante.
Status of This Notice: FINAL
This is a final advisory. Although Cisco cannot guarantee the accuracy of
all statements in this advisory, all of the facts have been checked to the
best of our ability. Cisco does not anticipate issuing updated versions of
this advisory unless there is some material change in the facts. Should
there be a significant change in the facts, Cisco may update this
advisory.
A stand-alone copy or paraphrase of the text of this security advisory
that omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain factual
errors.
Distribution
This advisory will be posted on Cisco's worldwide website at
http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml.
In addition to worldwide website posting, a text version of this advisory
is clear-signed with the Cisco PSIRT PGP key having the fingerprint FEB1
1B89 A64B 60BB 4770 D1CE 93D2 FF06 F236 759C and is posted to the
following e-mail and Usenet news recipients:
* cust-security-announce@cisco.com
* bugtraq@securityfocus.com
* full-disclosure@lists.netsys.com
* first-teams@first.org (includes CERT/CC)
* firewalls@lists.gnac.com
* cisco-nsp@puck.nether.net
* cisco@spot.colorado.edu
* comp.dcom.sys.cisco
* Various internal Cisco mailing lists
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on mailing
lists or newsgroups. Users concerned about this problem are encouraged to
check the above URL for any updates.
Revision History
+-------------------------------------------------+
| Revision 1.0 | 2002-September-03 | Initial |
| | | public |
| | | release |
+-------------------------------------------------+
Cisco Security Procedures
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and registering to
receive security information from Cisco, is available on Cisco's worldwide
website at http://www.cisco.com/go/psirt. This includes instructions for
press inquiries regarding Cisco security advisories.
----------------------------------------------------------------------
This advisory is copyright 2002 by Cisco Systems, Inc. This advisory may
be redistributed freely after the release date given at the top of the
text, provided that redistributed copies are complete and unmodified,
including all date and version information.
----------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8
Comment: Signed by Sharad Ahlawat, Cisco Systems PSIRT
iQA/AwUBPXTpuZPS/wbyNnWcEQKH3QCgqX/zUSCmAGdEztRECYxMzA9DkzQAoPUZ
zlE2/1p6Twm7HHuunr1vQ2p7
=C4g0
-----END PGP SIGNATURE-----
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: PGP 6.5.8
mQGiBD0HcvwRBADMNGazqD/bDWjJVBKrPrW3vSRReXB5y2HGfmZXS0C4xB/3VJGR
d+JeTnqam4q7hbBab9kery6cNL9cdZWI+LInX8DUT/s+vlUTrIdZmAphxKtDwZLw
W9rXKLQMeVpNfb64SrIqlcjq/DGEYAqVt3ycPXJiPl8JroDaKFSG1vKbTQCg/xJG
Ljl1bWvPx6O602cNaX5BrmUEALMSC++ppvP587TCHSdLzhfVBWw+zbt2a+gTkahz
t+VhymnBNWxNIlbU/U1StEaFwfBVPliVKmTj5LQwPetbIf783q+5ak0W9FM8BYy8
9XVt8S/AYdYRw5/1YJA3OnprdIwaMDDtrQEy/dmpHYe0Vcay5tSM4M2MgOHJcVba
hgktBACUHDDduj1qRzEybgLPSmwNS9jFpMC4PebBrw9c2O9idUufGt5A5we/ii5U
G/0s4vpr1zGhKPbmzWaU5+jSH1XfPVg3EF8H5K7meC7LVPYwYjYi6z1ir07zhEfD
wDRil5qve6rJNEZX5GLEysDhXYTw8hrwVv7bJSSlsJiMEqllEbRHQ2lzY28gU3lz
dGVtcyBQcm9kdWN0IFNlY3VyaXR5IEluY2lkZW50IFJlc3BvbnNlIFRlYW0gPHBz
aXJ0QGNpc2NvLmNvbT6JAF4EEBECAB4FAj0HcvwFCQW9+IAICwMJCAcCAQoCGQEF
GwMAAAAACgkQk9L/BvI2dZwoYwCgrFpZ5dh8IPAt4C/hkz6o+H9b6IwAoL+kvWjx
0Ij9mhNoEH+woJJCKjh2iQBKBBARAgAKBQI9B4cLAwUBeAAKCRCKY8lJ671ScWeu
AJ9QQeUds+YrB8knbCMdoOIizI44pwCfVsbFKOS2mnR6GuPGRHx6TYap/ieJAEYE
EBECAAYFAj0H3ooACgkQGoGomMEqmWyzPACeMnMro1hvO4ka23G2Z6JhZldeRVEA
oNom27aJ3+OxrhaUtBJt/SWVdVafiQBjBBARAgAjBQI9B4ieAwUBeBgGPFtePl0r
W0AuXWNpc2NvXC5jb20+JAAACgkQcJKanG3DGCHNdwCeP+XUPnt12BVZYAf5J+6Q
g5d9wTAAoM2XXNqrMm5Y/ScvExXoYXyk/q81iQCcBBABAQAGBQI9B4TXAAoJEMAF
eq0PniW5vLwEALCv9TkPbxdn29NzZJkI9vAqnX4OV79LfvQsB1J+Sck3f1lsvamq
r6kUsfqz2P4sB52KjZi8Cci3AHDP7Z5Iwl56raNiPEA00uUXh4vk1N7dTA4OfjDp
1LSciYHYOYxh6d3v47GphnBNckOdCH9iuaWJuRX86SHtshyJvHmR+wOtiQBGBBAR
AgAGBQI9B4ZCAAoJEOJaQ7r9SlMepRMAoPIlX+Pem9o5r1UjjpxT7aQyiFP/AKCz
yyQzbP5/IizPfxB2GTK92QSZVYkARgQQEQIABgUCPQeGcQAKCRCXb+VkX5DhIof5
AKC87+Znu5p+y69Z/szsL5fYv+RT2QCg6TMl/IeLDU9D+hwG6FqHBQbRyuWJAGME
EBECACMFAj0Pq4IDBQF4GAY8W14+XStbQC5dY2lzY29cLmNvbT4kAAAKCRD4P8wi
wv94DQX8AJ4mPJORrcEkCQxe7joRf1VJNzvITQCglE7/y1X9T0iI3tpO2zBo5uyb
KU+JAEYEEBECAAYFAj0XzCQACgkQSQjoesB49NLGSwCdGAFWJOOBFFBBQWiUyQ3l
7a596OIAoM/iw5ARHocvByCSsHlkYAvORdbIiQEcBBABAgAGBQI9HQOaAAoJELe9
L3c4tW498B4H/iXMyJpr0u6hU1xaGpPklQjI9oB3TpH0ASxi/SmlGZ1Y/xNzxxrC
RjPBnRwvPVUSPzJidlF9SGhsGGZVBAfUbMihwmnPr0kbM8SoZGNqF0Vzqraim/ds
wiw4QUWSGw3csw8h18wtfxipNipnjP06qilHiIHipN4Q7nhuV3nQ+8o8Bz7sZvZS
ei6JfkT21BcHCLtxfI0022jeTSoQG6GqQjs02rbIKBjOj98Qr6yt4lu4EY3LNMDW
N9dX+usAf43e2asizF5k1ALIbktaEZQDgq2FYWwXFw1UTlB8lpl4uL5OZ78Bx18V
NFBedZ4jqIvj8jGk8CbKA8fNOd9EIioXyqm0UENpc2NvIFN5c3RlbXMgUHJvZHVj
dCBTZWN1cml0eSBJbmNpZGVudCBSZXNwb25zZSBUZWFtIDxzZWN1cml0eS1hbGVy
dEBjaXNjby5jb20+iQBGBBARAgAGBQI9B3NPAAoJEJPS/wbyNnWc8bcAoL4jgdol
jMJs8qkGV5s9L8EVHodgAJ41Pnr7cL0AV2cBvdiJjJX0UAOJnokASgQQEQIACgUC
PQeHHwMFAXgACgkQimPJSeu9UnEShwCfUen+P64gmYXlf6aWMoBudz7/gEgAoKHP
GMzGRTLPQ2VO27AXfM1qMqOPiQBGBBARAgAGBQI9B96TAAoJEBqBqJjBKplsY2IA
oN/eovYSQsE34i2tfeSy/3X8vFWXAKDgnRmSe9SGdtLIDXZbPI9VshGnEIkAYwQQ
EQIAIwUCPQeItwMFAXgYBjxbXj5dK1tALl1jaXNjb1wuY29tPiQAAAoJEHCSmpxt
wxghLBgAn2cjBC9yOd14unFoJrXv0eKixEQaAKCsDBGsECGI+ru8keXJ2zJYSOF+
74kAnAQQAQEABgUCPQeFBwAKCRDABXqtD54lua3JBAC+O2uyXzj8wMTThpgeoeBT
95u4Smug8G+tPVrrkqd2SK8zXlpscAGQugklXw7drmj2Ph8bwocnQxDWQH9kCApj
eXCWGCBLZnsehghtkaofDq0wp7fugmDwhaRApsERHnRVlCNA/8vB5FMCBfJA6xkU
riRTvxEmHn5uwcDYgzFJB4kARgQQEQIABgUCPQeGeQAKCRDiWkO6/UpTHtTYAKCA
8pd5aARjTMjCBfXUL5HqesgeawCgh8pF7agO1H7E6YAoDEAcQK5QNVKJAEYEEBEC
AAYFAj0HhoQACgkQl2/lZF+Q4SJPKQCg62cLZCePXBq9fn/CUTJa0GeDepkAnjgh
YGC24VB+E5/4T3wsy98+tsgriQBjBBARAgAjBQI9D6uhAwUBeBgGPFtePl0rW0Au
XWNpc2NvXC5jb20+JAAACgkQ+D/MIsL/eA1YdACgp7PGp51wgiA9+nRqF8Be826b
4GYAoN0Xz7k6Vm2wtdANIMFc+11H5gdriQBGBBARAgAGBQI9F8wuAAoJEEkI6HrA
ePTS7KcAoLcgqYzzNY1g1WK9q/D0cIzzHstFAKDcBTGI3DNtJ6wnqzecq5WPxnmk
D7kCDQQ9B3L8EAgA9kJXtwh/CBdyorrWqULzBej5UxE5T7bxbrlLOCDaAadWoxTp
j0BV89AHxstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJPPT2N286Z4VeSWc39
uK50T8X8dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrUGvC/RgBYK+X0iP1Y
TknbzSC0neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8BD8KVbGI2Ou1WMuF040zT9
fBdXQ6MdGGzeMyEstSr/POGxKUAYEY18hKcKctaGxAMZyAcpesqVDNmWn6vQClCb
AkbTCD1mpF1Bn5x8vYlLIhkmuquiXsNV6TILOwACAgf/dfUAIBxFgArE2xwYooN3
n6fkM/LIuVIzixkyNSgqH9KaOJ41cn8jncbdt31tyH++aK7mMuyQm7nkgy/B8U7w
9xYORl1mOsgUSGylPLxo2vengnqBO+Ua5hcngfvLuDUV8N9Ai0TWPfyTveyRQSPY
ODOapdU8uCk3dFiZpgfTBh7hqlLRiNpTXHEK8dNsEy/q2HqLx/9hTQMXWqViK17q
CfmwRLO94W1RIk6+CTwIa6tN9+ZicthCHRvUTRxDLfuuyY7qrDa4QM6HFAO+NyN9
Z9SeZSlbGoUN+AAEPZ9ej1T5Ca0WLCD9tF5a+ujN/GrSg2EidGUh/phZXYKYYsrh
WYkAUgQYEQIAEgUCPQdy/AUJBb34gAUbDAAAAAAKCRCT0v8G8jZ1nP24AJ9nkeTV
qE6/EOoOIuhxwtihvhea6wCgx6iK+imU7xZZDSGl9RudFTo08Ew=
=UuaC
-----END PGP PUBLIC KEY BLOCK-----