[c-nsp] Cisco Security Advisory: Crafted IP Option Vulnerability

[Andre Gironda]

I would say that this would work:
http://addxorrol.blogspot.com/2007/01/one-of-most-amusing-new-features-of.html

It requires expensive software, BinNavi and IDA Pro Advanced, but
anyone equipped with those tools could do it.

I heard that parts of PaiMei work under BSD/Linux, and certainly GPF
and Autodafé could be used for fault injection during step-mode
debugging.  PaiMei also uses IDA.  The other tools are open-source
including PaiMei itself.

Using PyDBG in PaiMei could speed up the debugging faster than gdb by
way of scripting, which could allow things like process stalking.  If
that's the case, I could invision anyone with a symbol table could get
PoC remote code execution (ala Mike Lynn and Hacking Exposed: Cisco
Networks) within 3 hours and have a reliable exploit within 10 hours.

Worm at 11.

But PaiMei doesn't do that (yet), and nobody has the rest of the
resources to accomplish this task.  Right?

But, you don't really even need a symbol table if you have lots of
time to debug and design the exploit.  This is more advanced and would
require somebody like Halvar Flake, FX, or Pedram Amini.  All three of
which I credit for this vulnerability information feasibility
fact-finding.

So it's too late.  Don't bother upgrading now; you're already owned.
Unless they are blocking it at the ISP borders in the same way they
blocked out the Cisco IPv4 Crafted DoS vulnerability in 2003.  ISP's
probably got the patch (or at least Cisco's ISP's did) a week ago.
Had rolling reboots lately?  Don't know why?  Lots of "miscellaneous"
ISP maintenace.  I wonder...

Hey Cisco - listen up.  Hire some vulnerability assessors before the
future probable Month-of-Cisco-Bugs becomes Year-of-Cisco-Bugs aka
loss of 10B US dollars in revenue.  Or whatever John Chambers makes,
whichever is lower.

-dre

On 1/24/07, Kevin Graham <mahargk at gmail.com> wrote:
> On Wed, 24 Jan 2007, Cisco Systems Product Security Incident Response
> Team wrote:
>
> > Cisco Security Advisory: Crafted IP Option Vulnerability
>
> If I recall correctly, this is the first (PSIRT acknowledged)
> stack/heap vulnerability since Michael Lynn's much-publicized BlackHat
> presentation. While there was plenty of brief speculation at the time
> of what Chinese/Russian/American-xenophobic-target hax0rs had already
> implemented, not much bubbled up to the operational world...
>
> Does anyone more active in the security community have pointers as to
> how generic (and common) are tools targeting IOS exist?
>
> On 1/24/07, Paul Stewart <paul at paulstewart.org> wrote:
>
> > I have read over this and am "fearful" of what I read.. my first thought
> is
> > to drop everything, get emergency maintenance window releases and spend a
> > couple of nights upgrading like crazy...
>
> "20070124-crafted-tcp" seems obvious enough (though it would've been
> good for PSIRT to indicate how "small" the leakage per packet is to
> gauge CoPP values), but "20070124-crafted-ip-option" likely should
> tingle your spine.
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>