FW: Cisco Bug 44020

["Noren, Bill" <Bill.Noren () PaeTec com>]

Hey folks,

It turns out that the tar file Shanphen mentions below is empty.  I found it
at:  http://www.k-otik.com/exploits/07.21.cisco-bug-44020.c.php

with a link to working .gz as well.  It looks like a cleanup of the original
exploit but still relying completely on exploiting via protocols 53, 55, 77
and 103.

FWIW, I grabbed a copy of shadowchode.c and ran it against a lab 2611
running 12.1(16) and it locks the interface quite nicely after 38 iterations
of the code (one half of 76 ;-).  This takes about 0.4 seconds to complete.
I was also serially connected at the time and although IP traffic was
blocked I could easily work within the router and save to NVRAM and issue a
reload command.  Good news for those of you still vulnerable with terminal
access to your equipment.

After re-booting, (lol!) I applied an ACL to block those protocols on the
incoming interface from my laptop and the exploit no longer worked against
that interface or one on the other side of the router.  

For giggles I decided to recompile the code for protocols 54, 56, 78 and 104
and tried all over again and was not successful.  I don't remember seeing in
any of the threads if the protocols were specific but from my ever-so-random
test it appears they are.  Granted, I may have overlooked that part
somewhere and I'm still reviewing all of this, especially for new exploits
that may be uncovered because of all of this.

Cheers,
-Bill

-----Original Message-----
From: Shanphen Dawa [mailto:list () hardlined com] 
Sent: Tuesday, July 22, 2003 1:45 PM
To: full-disclosure () lists netsys com
Subject: [Full-disclosure] Cisco Bug 44020

Here is supposedly a working Cisco exploit:
http://www.elxsi.de/cisco-bug-44020.tar.gz
This is pasted from security focus:
http://www.securityfocus.com/archive/1/329765/2003-07-19/2003-07-25/0

To: 
BugTraq

Subject: 
Cisco IOS exploit (44020)

Date: 
Jul 21 2003 4:01PM

Author: 
Martin Kluge <martin elxsi de>

Message-ID: 
<20030721160132.GA61689 () elxsi de>


.. snip ..





_____________________________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html