Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security IT

Cisco Patches 'Black Hat' IOS Flaw 66

Posted by Zonk from the spraypainted-white dept.
thursnick writes "eWeek is reporting that Cisco has finally issued a comprehensive fix for a critical IOS vulnerability that set off a firestorm of controversy at the Black Hat Briefings earlier this year. The patches come more than three months after former ISS researcher Michael Lynn quit his job to present the first-ever example of exploit shellcode in Cisco IOS (Internetwork Operating System), a presentation that landed him in legal hot water. Cisco's advisory effectively confirmed Lynn's summer warning that the flaw could be exploited by remote attackers to execute arbitrary commands or cause a denial-of-service on compromised routers."
This discussion has been archived. No new comments can be posted.

Cisco Patches 'Black Hat' IOS Flaw More

Cisco Patches 'Black Hat' IOS Flaw

Comments Filter:

  • Wow, quick turnaround... (Score:3, Funny)

    by Stormeh ( 927626 ) on Thursday November 03, 2005 @12:14PM (#13942101) Homepage
    Awesome, and it's only been how many months?
  • Why on earth did Cisco not release this earlier? It would save people alot of trouble.

    • Re:Why not earlier? (Score:5, Informative)

      by scheme ( 19778 ) on Thursday November 03, 2005 @12:33PM (#13942268)
      Why on earth did Cisco not release this earlier? It would save people alot of trouble.

      If you read TFA, the bug involved system timers and how they were handled. Given that this probably affects most of the system functions, it's not surprising that it would take a while to make the changes and test it. Think about how long it took to fix the VM bugs in linux 2.4, this probably a change of similar magnitude.

    • This is a related problem, but it's not the same one:
      This advisory documents changes to Cisco IOS® as a result of continued research related to the demonstration of the exploit for another vulnerability which occurred in July 2005 at the Black Hat USA Conference. Cisco addressed the IPv6 attack vector used in that demonstration in a separate advisory published on July 29, 2005.

  • Cisco vs. Microsoft (Score:4, Funny)

    by mandreko ( 66835 ) on Thursday November 03, 2005 @12:18PM (#13942138) Homepage
    looks like Cisco is trying to beat Microsoft for patch times
  • When did geeks become gangsters? WTF dude! Today's secret word is: arcing. For the rest of the day, whenever anybody says the secret word, scream real loud!
  • /me wonders if this is just described as "A patched undisclosed vuln. of low priority" or some such rot in the update... Petyr Rahl

  • patching ciscos... (Score:2, Informative)

    by Anonymous Coward
    So now we can all visit CiscoUpdate and have our routers automatically patched....?

    Or do we have to manually evaluate lengthy decision diagrams, check memory requirements, prove that we have legally bought the affected hardware and software, and hope that the monolythic IOS image will not introduce bugs into other areas that are being patched by this fix?
    • You have to follow that requirement, today.

      (Not that non-monolithic systems are necessarily exempt from the patch breaking other systems)

      However (while off topic), it should be noted that 12.2XR (7600 only, today, but where else are you going to see this level of change) is no longer monolithic. It's a HUGE change in the architecture brought about to address just the type of issues discussed.

  • What ever happened... (Score:5, Interesting)

    by Anonymous Coward on Thursday November 03, 2005 @12:29PM (#13942230)
    So, what ever happened to Michael Lynn? He quit his job and made the presentation but, where is he today? Is he employed? Is he proud of what he did? Does he feel the price he paid was worth what he gave up for 15 minutes in the spot light? Would he recommend his "high road" choice to others in the future? Does he feel that he really made any difference in the end?

    • Re:What ever happened... (Score:5, Informative)

      by Ckwop ( 707653 ) on Thursday November 03, 2005 @12:38PM (#13942327) Homepage
      He's alive and well as far as I know. I saw him at Toorcon this year, but didn't speak to him.. (He was a speaker and gave a good talk on Reverse Engineering)

      I know that he has a new job and I while I obviously can't speak for him, I got the impression that he felt as if he did his duty the security community. As an amateur member of that community, I'd thought that he put principle before pay and deserves our respect.

      Simon.

      • Re:What ever happened... (Score:5, Informative)

        by Anonymous Coward on Thursday November 03, 2005 @01:14PM (#13942634)
        Mike is working at Juniper, and doing well (Juniper pays better than ISS, apparently, and their code is cleaner than Cisco's, plus they have some ethics). He feels he did the right thing. So do a lot of folks in the US military and intelligence communities, who are very very pissed off at Cisco for exposing them to a security risk of this magnitude and trying to cover it up. They consider Mike a hero, so he has some very useful new friends...

        • Re:What ever happened... (Score:4, Insightful)

          by Wellspring ( 111524 ) on Thursday November 03, 2005 @05:55PM (#13945811)
          I'm glad. I love it when the right thing (for him) is also the Right Thing (ethically).

          The coverup is almost always worse than the crime in these kinds of things. Companies that aren't up-front and honest (trying to protect their reputation) end up trashing their reps. Cisco just created an anecdote for the next time a customer or regulator wants to take a deep, careful look at their security. We can't just take their word for it, and if I were buying routers right now, I'd be much more inclined to look at Juniper than Cisco, even though previously I wouldn't have even considered them.

          It's not magic pixie dust, but making the effort to bring hard-core ethics onstaff is important to me.
  • Seems Cisco should be in legal hot water not Lynn. Why would we "shoot the messenger"? Kinda like blaming the little boy in "the emperors new clothes".
  • It looks like this patch adds countermeasures to the original patch for this problem back in July? Here [cisco.com] was the initial patch for this problem.
    • Thank you. I was wondering about this. Jokes about "keeping up with Microsoft" aside I believe Cisco did provide an initial patch and this is a much more comprehensive patch that actually fixes the core problem.

      Everyone always bashes MS for releasing patches that simply prevent a working/known exploit w/o fixing the core issue. Cisco has done both now and even though I think they handled this very poorly on both the PR front, and with their behaviour towards Lynn, I do applaud them for taking the two step a

  • The question is....... (Score:4, Interesting)

    by 8127972 ( 73495 ) on Thursday November 03, 2005 @12:37PM (#13942315)
    ..... Is this safe enough to deploy or should it be dropped into a test environment of some sort before deploying into a production environment? That assumes of course that admins have the luxury of delaying the deployment of this.

    • Re:The question is....... (Score:5, Informative)

      by anticypher ( 48312 ) <[moc.liamg] [ta] [rehpycitna]> on Thursday November 03, 2005 @01:26PM (#13942767) Homepage
      The answer is.....

      This code has been out for a few months now, and many select beta sites have been testing it in production environments. The first few iterations had some serious (crash and reboot every few hours) problems, but it (12.2.15T1thru17) has been in production use on several edge routers for a month with no noticable problems. Cisco didn't just patch the one 'sploit published, they categorised the class of exploits and went about fixing many different possible attack vectors or watching for suspicious behaviour that could indicate a compromised system. That is what took several months even before Michael's talk, and its been in testing (and re-patching and recursion testing) since then. The announcement today is because they are confident their fix is solid, but anyone staying at the bleeding edge of IOS releases has been using it since at least June.

      I'd say its solid, but I'm not rolling out the latest version on everything until others add some real world stress testing. I'm sure there will be several more newly introduced bugs uncovered in the new few months, and the timer checks usually result in a panic reload, not optimal for stable systems with SLAs and big money riding on them.

      I'm also not in a rush to roll this out, because for the moment there are no known exploits running around. Maybe Effugas or some of the IOS engineers (I know you read /.) can add something to this thread.

      the AC
    • so... you actually consider deploying a patch in production without testing it?.....Thanks god I'm not one of your lan users

  • Great (Score:3, Funny)

    by Atlantic Wall ( 847508 ) on Thursday November 03, 2005 @12:38PM (#13942324)
    Great, Now how long before everyone implements this and all of the other patches that need to be done on the cisco routers. OK the patch is out, but when will they all be patched, probably another 3-6 mo. So this is a hackers last call sort of, if you have not exploited this yet, time is running out, soon. So get in ur haxoring.

  • Boy oh boy (Score:3, Funny)

    by MightyMartian ( 840721 ) on Thursday November 03, 2005 @12:49PM (#13942423) Journal
    Do I feel bad about abandoning Cisco for Linux and IPTables. I mean, there's nothing quite as fun as upgrading Cisco's IOS. It's right up there with root canals in my book of things I like to experience.
    • heh.. hell of a lot easier than say.. linux? even an operation as simple as "emerge system" takes forever and could end up in a broken box.

      copy flash tftp
      copy run tftp
      copy tftp flash
      reload

      not too bad..
      • You left out Steps 5, 6 and 7:

        Remove fan grill
        Insert penis
        Pray that the networking gods accept the sacrifice placed before them

        • And, if that fails, step 8 where you get to sit in Cisco's queue for six hours waiting for someone to offer you technical support, only to be told "Are you certain you've paid for support, sir?"

  • Two scary bits" Completely Compromised (Score:3, Interesting)

    by fuzzy12345 ( 745891 ) on Thursday November 03, 2005 @12:57PM (#13942487)
    From TfineA:

    "In many cases, a heap-based overflow in Cisco IOS will simply corrupt system memory and trigger a system reload when detected by the "Check Heaps" process, which constantly monitors for such memory corruption."

    Is anyone else bothered that Cisco figures heap corruption is common enough that a process is running full time on production routers looking for it? I suppose you could view this as proactive, but obviously the process can only look for nonmalicious corruption, and is only statistically likely to find corruption before it causes errors according to how much CPU you give it.

    "In some cases it is possible to overwrite areas of system memory and execute arbitrary code from those locations. In the event of successful remote code execution, device integrity will have been completely compromised,"

    Think about it. Once an exploit is executed against your router, reloading your firmware isn't an option, because that's a function of your firmware, which could be corrupted. Unlike a computer OS virus, which can be circumvented by rebooting and taking control before the corrupted OS does, there's no way to preempt the corruption here. For total peace of mind, you'd either have to replace the (probably not socketed) flash chips, or take the whole unit out back and burn it. Am I wrong? Of course, that's not going to be Cisco's recommended solution.

    • Is anyone else bothered that Cisco figures heap corruption is common enough

      I'm bothered. In fact, this reminds me of how DJB's software almost always users the supervise daemon to ensure your process is running. It keeps track of all of djb's software, and you can run it with most other daemons.

      What happened to writing good software? Why should you have a daemon check for corruption? Why should you have a daemon that checks to see if other daemons die? Wait! Wasn't the author of the daemon-that-might-die so

    • Re:Two scary bits" Completely Compromised (Score:4, Informative)

      by gclef ( 96311 ) on Thursday November 03, 2005 @01:30PM (#13942818)
      Cisco doing heap checking is a mark of a reasonable system doing checks on itself. Why is this bad? They almost never use the stack, so they check the memory they are using a lot. It doesn't run often (Lynn found it running about once every 30 seconds or so), and it's a good thing to do. Why complain?

      As for reloading firmware, I don't think you understand Cisco stuff. There is a mini-firmware burned into ROM on all the Routers & Switches...it's called ROMMON mode on the ones that immediately come to mind. If your device firmware is totally thrashed (by a worm, by some damn fool tftp'ing up an image for the wrong router type, etc) you'd just use ROMMON mode to re-load a good image. Now, the real problem is that a worm could trash your flash storage.

      In that case, unless you've got one of the expensive boxes with removable flash cards, you've now got a very expensive paperweight.

      • Re:Two scary bits" Completely Compromised (Score:1, Interesting)

        by Anonymous Coward

        Cisco doing heap checking is a mark of a reasonable system doing checks on itself.

        It's a mark of a *bad* system. Why? Because 1) it means they believe they haven't properly written their software and, more importantly, 2) it doesn't guarantee you anything except "the heap was consistent up to 29 seconds ago". Who cares? I need the heap to be consistent *all* the time.

        The best thing is to just write the code correctly, the next best thing is to place some kind of "barrier" (at the hardware level? Who

    • Memory coruption happens it's a function of radiation and ECC does not fix/catch all of it. Routers have uptimes counted in years unlike your average PC or windows server so yes it does make a bit of sence.

      Well most cisco routers have socketed and/or slot based flash. The slot based ones have these realy cute write protect switches on the end.

  • "First-ever exploit" (Score:1, Informative)

    by Anonymous Coward

    The patches come more than three months after former ISS researcher Michael Lynn quit his job to present the first-ever example of exploit shellcode in Cisco IOS (Internetwork Operating System), a presentation that landed him in legal hot water. Cisco's advisory effectively confirmed Lynn's summer warning that the flaw could be exploited by remote attackers to execute arbitrary commands or cause a denial-of-service on compromised routers."

    It was not the first-ever example of exploit shellcode in IOS, Phenoe [phenoelit.de]

  • "Cisco is not aware of any active exploitation of this vulnerability"
    Right.
  • Hey, I'm all mixed up with this advisory.

    My router has version 12.4(2)T1, is it affected? The advisory says that all version are affected, but it seems to propose version 12.4(2)T1 as a fix.

    Could someone shed some light one this?

Slashdot Top Deals

"Pull the trigger and you're garbage." -- Lady Blue

Close