Cisco Exploits Released

[Howell, Paul]

At http://www.cisco.com/warp/public/707/cisco-sn-20040326-exploits.shtml

Cisco Security Notice: Exploit for Multiple Cisco Vulnerabilities
Document ID: 50220
Revision 1.0 
For Public Release 2004 March 27 19:30 UTC 

----------------------------------------------------------------------------
----

Please provide your feedback on this document.

----------------------------------------------------------------------------
----

Contents
Summary
Details 
Workarounds 
Status of This Notice: INTERIM 
Revision History 
Cisco Security Procedures 

----------------------------------------------------------------------------
----

Summary 
Proof-of-concept code has been publicly released by an external group that
exploits multiple previous vulnerabilities in various Cisco products. 

Details 
Proof-of-concept code has been publicly released that exploits multiple
previous vulnerabilities in various Cisco products. The following list of
vulnerabilities taken verbatim from the exploit code are affected. Included
after each is a URL which may be referenced for more information regarding
each vulnerability where Cisco has previously released a security advisory
or response to address the issue. Customers should take steps to ensure that
they have addressed each of these either via a software upgrade or
workarounds in place as appropriate in order to mitigate any risk from this
new exploit code.

Cisco 677/678 Telnet Buffer Overflow Vulnerability 

CBOS - Improving Resilience to Denial-of-Service Attacks 

http://www.cisco.com/warp/public/707/CBOS-DoS.shtml 

Cisco IOS Router Denial of Service Vulnerability 

Cisco IOS HTTP Server Vulnerability 

http://www.cisco.com/warp/public/707/ioshttpserver-pub.shtml

Cisco IOS HTTP Auth Vulnerability 

IOS HTTP Authorization Vulnerability 

http://www.cisco.com/warp/public/707/IOS-httplevel-pub.html 

Cisco IOS HTTP Configuration Arbitrary Administrative Access Vulnerability 

IOS HTTP Authorization Vulnerability 

http://www.cisco.com/warp/public/707/IOS-httplevel-pub.html 

Cisco Catalyst SSH Protocol Mismatch Denial of Service Vulnerability 

Cisco Catalyst SSH Protocol Mismatch Vulnerability 

http://www.cisco.com/warp/public/707/catalyst-ssh-protocolmismatch-pub.shtml


Cisco 675 Web Administration Denial of Service Vulnerability 

Cisco is currently researching this vulnerability further. Mitigation
methods have been available for some time such as setting the Web server to
listen on a different port: 

"Code Red" Worm - Customer Impact 

http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub.shtml#workaroun
ds

and through bugs resolved in the following advisory where the Web server
under Cisco CBOS was enabled by default and listening on port 80 even when
the Web server was not configured. 

CBOS Web-based Configuration Utility Vulnerability 

http://www.cisco.com/warp/public/707/cisco-cbos-webserver-pub.shtml 

Cisco Catalyst 3500 XL Remote Arbitrary Command Vulnerability 

Catalyst 3500 Issue 

Report: http://www.securityfocus.com/archive/1/141471 Cisco Response:
http://www.securityfocus.com/archive/1/144655 

Cisco IOS Software HTTP Request Denial of Service Vulnerability 

Cisco IOS HTTP Server Query Vulnerability 

http://www.cisco.com/warp/public/707/ioshttpserverquery-pub.shtml 

Cisco 514 UDP Flood Denial of Service Vulnerability 

A Vulnerability in IOS Firewall Feature Set 

http://www.cisco.com/warp/public/707/IOS-cbac-dynacl-pub.shtml 

Workarounds 
Possible workarounds for each of the vulnerabilities may be found in the
advisories referenced in the Details section. 

Status of This Notice: INTERIM 
This is an interim notice. Although Cisco cannot guarantee the accuracy of
all statements in this notice, all of the facts have been checked to the
best of our ability. Cisco does not anticipate issuing updated versions of
this notice. Should there be a change in the facts, Cisco may update this
notice. 

A stand-alone copy or paraphrase of the text of this security notice that
omits the distribution URL in the following section is an uncontrolled copy,
and may lack important information or contain factual errors. 

Revision History 
Revision 1.0
 2004-March-26
 Initial public release.
 


Cisco Security Procedures 
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and registering to
receive security information from Cisco, is available on Cisco's worldwide
website at http://www.cisco.com/warp/public/707/sec_incident_response.shtml.
This includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt.

------------------------------------------------------------------------
To unsubscribe from netsec, send mail to majordomo@merit.edu
with a body consisting of the words "unsubscribe netsec" --
without the quotes. For more help, send a message to majordomo@merit.edu
with the word "help" as the body.
------------------------------------------------------------------------