[ http://www.rootshell.com/ ] I dont know of anybody ever posting anything on this sbuject, so i'll go ahead. I found a buffer overflow in the cisco 76x series router. The bug exists only in the 4 users limit software, i couldn't reproduce it with the unlimited version. When i reported the bug to cisco I promised them that i'll post this info to public if they dont fix it withing a week. It was over a month ago, and i was never notified of any fix so i'm asuming they didnt make any fix. I also cant find any mentioning of this bug on their web site by searching for the bug id. The exploit is prety simple: telnet cisco762.domain.com Trying 1.2.3.4... Connected to 1.2.3.4. Escape character is '^]'. Enter Password:Enter a veryyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy yyyyyyyyyyyyyyyyyyyyyyyyyyyy long string here and watch the prety lights go on as the cisco reboots, or imagine your victim tearing his hair out. ---------------------------------------------------------------------------- IOS has proably a pound more of them. While not exploitable from outside I can crash my CISCO 1005 running IOS 10.3(8) by setting the MTU to 15kb. A couple of seconds later the box will freeze. Just to show how tested the thing is ... IOS is probably not as badly affected as other operating systems because few people outside of CISCO have the required knowledge about the OS internals, so writing a useable exploit is hard. Ralf ---------------------------------------------------------------------------- Interim Field Notice: 7xx Router Password Buffer Overflow December 15, 1997, 17:00 US/Pacific, Revision 1 Summary - ----- Some Cisco 7xx routers can be crashed by connecting with TELNET and typing very long password strings. There exists a possibility that this bug could be exploited to take complete control of the router, rather than simply crashing it. Who Is Affected - ------------- All Cisco 7xx routers running IOS/700 software version 4.1(1), 4.1(2), or 4.1 interim releases earlier than 4.1(2.1) are affected. Systems running releases earlier than 4.1 are not affected. In order to exploit the vulnerability, an attacker must have access to the password prompt. This means that the attacker must be able to TELNET to the target router, or to gain access to its console port. Impact - ---- This vulnerability allows attackers to force 7xx routers to reboot, denying service to legitimate users during the reboot period, and possibly causing excessive "call flapping" as routers shut down and restart. It is possible that including the right data at the right place in the too-long password string could enable an attacker to take complete control of the router. Cisco has not fully evaluated the actual feasibility of this attack. A person who succeeded in such an attack would be able to reconfigure the router or modify its functionality, theoretically in any way at all. It is also possible that certain data strings, while not permitting total control of the router, could cause it to hang indefinitely rather than crashing, or to malfunction in other ways. Cisco has not fully evaluated the possible effects of all possible data strings. Details - ----- This vulnerability has been assigned bug ID CSCdj66458. Insufficient bounds checking on the data buffer used for password input allows the incoming password to exceed the buffer size, overwriting the contents of memory beyond the end of the buffer. When the system tries to use the now-incorrect data in that memory, unpredictable results occur. If the data are randomly chosen, this unpredictable behavior can be expected to result in the detection of errors, such as accesses to illegal addresses, which result in system crashes. It might be possible to craft a data string that, instead of creating detectable errors, caused particular system behavior desired by the attacker. Affected Cisco IOS/700 Software Versions - -------------------------------------- This vulnerability affects systems running IOS/700 version 4.1 releases, including 4.1(1), 4.1(2), and 4.1 interim releases earlier than 4.1(2.1). IOS/700 releases other than 4.1 are not affected. Planned Software Fixes - -------------------- Cisco is presently testing a software fix for this problem. We expect the fix to be ready for customer use by December 24, 1997. Because of the exigencies of the software development and testing process, we cannot guarantee this date. Please check the copy of this notice on Cisco's Web page for updated information about the status of the fixed release. When the fixed software is available, this page will include instructions for obtaining it. Cisco will be making the fixed software available to all IOS/700 customers who are presently running 4.1 software, regardless of contract status. Workaround - -------- The vulnerability may be avoided by controlling access to the system console port, and by restricting access to the TELNET facility to trusted hosts. TELNET access may be restricted either by using filters on firewalls or surrounding routers, or by using filters on the 7xx router itself. To restrict access to the TELNET service on a 7xx router running 4.1(x) software to a single trusted management host, use the command set ip filter tcp in source = not trusted-ip-address destination = 7xx-address:23 block The command should be applied in every profile that may be active when the router is connected to a potentially hostile network. Exploitation and Public Announcements - ----------------------------------- Cisco has had no known reports of malicious exploitation of this vulnerability. This vulnerability has been discussed on the "bugtraq@netspace.org" mailing list, and is therefore certain to be widely known in the cracker community. The first public announcement of this vulnerability of which Cisco is aware was on December 11, 1997. The vulnerability can be exploited to crash systems with no special tools or knowledge; no exploitation program as such is required. Assuming that it is possible to exploit the vulnerability to take total control of the system, an exploitation program would be needed in order to do so. A person seeking to develop such an exploitation program would need to be a competent assembly language programmer. She would also need detailed knowledge of the internal workings of the IOS/700 software and/or the 7xx router hardware. Such knowledge has not been made public by Cisco, but could be obtained by reverse engineering or by theft of trade secrets from Cisco. Status of This Notice - ------------------- This is an interim field notice. Because Cisco customers are in immediate need of timely information about the issues addressed, this notice has been issued with less review and less fact-checking than is customary in corporate public statements. Although Cisco believes all statements in this notice to be correct, readers must understand that the potential for error does exist. Errors may include both factual errors and errors of editing, formatting, and emphasis. Readers of this notice rely on the information herein at their own risk. This notice will be updated as more information becomes available. The status of this notice will be changed from interim to final when complete, fully verified information is available. Distribution - ---------- The initial version of this notice is being sent to the following Internet mailing lists and newsgroups: * cisco@spot.colorado.edu * comp.dcom.sys.cisco * bugtraq@netspace.org * first-teams@first.org (includes CERT/CC) Future versions of this notice will be posted on Cisco's Web site, but will not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the Web site for updates. This notice will be posted in the "Field Notices" section of Cisco's Worldwide Web site, which can be found under "Technical Tips" in the "Software and Support" section. The URL is http://www.cisco.com/warp/public/770/pwbuf-pub.shtml. The copy on the Worldwide Web will be updated as appropriate. Revision History - -------------- Revision 1, 17:00, Initial version. 15-DEC-1997 Cisco Security Procedures - ----------------------- Please report security issues with Cisco products, and/or sensitive security intrusion emergencies involving Cisco products, to security-alert@cisco.com. Reports may be encrypted using PGP; public RSA and DSS keys for security-alert@cisco.com are on the public PGP keyservers. The alias security-alert@cisco.com is used only for reports incoming to Cisco. Mail sent to security-alert@cisco.com goes only to a very small group of users within Cisco. Neither outside users nor unauthorized Cisco employees may subscribe to security-alert@cisco.com. We will shortly be creating a security announcement mailing list for outgoing information. When that list is created, an announcement will be sent to appropriate Internet forums. Please do not use security-alert@cisco.com for configuration questions, for security intrusions that you do not consider to be sensitive emergencies, or for general, non-security-related support requests. We do not have the capacity to handle such requests through this channel, and will have to refer them to Cisco's Technical Assistance Center, delaying response to your questions. We advise contacting the Technical Assistance Center directly with this type of question. - ------------------------------------------------------------------------ This notice is copyright 1997 by Cisco Systems, Inc. This notice may be redistributed freely provided that redistributed copies are complete and unmodified, including all date and version information. - ------------------------------------------------------------------------