- NANOG - lists.nanog.org

Cisco Security Advisory: Cisco Telnet Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 27 Aug '04

27 Aug '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Telnet Denial of Service Vulnerability Revision 1.0 For Public Release 2004 August 27 1000 UTC - ------------------------------------------------------------------------- Contents Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice: INTERIM Distribution Revision History Cisco Security Procedures - ------------------------------------------------------------------------- Summary ======= A specifically crafted Transmission Control Protocol (TCP) connection to a telnet or reverse telnet port of a Cisco device running Internetwork Operating System (IOS) may block further telnet, reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and in some cases Hypertext Transport Protocol (HTTP) access to the Cisco device. Telnet, reverse telnet, RSH and SSH sessions established prior to exploitation are not affected. All other device services will operate normally. Services such as packet forwarding, routing protocols and all other communication to and through the device are not affected. Cisco will make free software available to address this vulnerability. Workarounds, identified below, are available that protect against this vulnerability. This vulnerability is documented in Cisco bug ID CSCef46191 ( registered customers only) . This Advisory is available at http://www.cisco.com/warp/public/707/cisco-sa-20040827-telnet.shtml. Affected Products ================= Vulnerable Products - ------------------- This vulnerability affects all Cisco devices that permit access via telnet or reverse telnet and are running an unfixed version of IOS. Products Confirmed Not Vulnerable - --------------------------------- Cisco products that do not run IOS are not affected. Details ======= Telnet, RSH and SSH are used for remote management of Cisco IOS devices. The SSH protocol is also used for Secure Copy (SCP), which allows an encryption-protected transfer of files to and from Cisco devices. HTTP is also used for management of certain Cisco devices. IOS versions prior to12.2(15)T include HTTP server version 1.0, which, if configured, will be unresponsive on a device that is under exploitation. IOS versions after and including 12.2(15)T include HTTP server version 1.1, which is unaffected. Reverse telnet is a feature that allows you to telnet to a Cisco device and then connect to a third device through an asynchronous serial connection. For more information on reverse telnet, consult the following documents: http://cisco.com/en/US/products/sw/iosswrel/ps1828/products_configuration_g… http://cisco.com/en/US/products/sw/iosswrel/ps1826/products_configuration_g… Cisco devices that are operating as a reverse telnet server may have ports open in the ranges of: * 2001 to 2999 * 3001 to 3099 * 6001 to 6999 * 7001 to 7099 After a specially crafted TCP connection to an IOS device on TCP port 23 or the reverse telnet ports listed above, all subsequent telnet, reverse telnet, RSH (TCP port 514), SSH, SCP (SSH and SCP use TCP port 22), and in some cases HTTP (TCP port 80) connections to the device experiencing exploitation will be unsuccessful. Any telnet, reverse telnet, RSH, SSH, SCP and HTTP sessions that are already established with the device will continue to function properly. In Cisco IOS, telnet, reverse telnet, RSH, SSH, SCP and some HTTP sessions are handled by a virtual terminal (VTY). Each telnet, reverse telnet, RSH, SSH and SCP session consumes a VTY. After successful exploitation, the Cisco device can no longer accept any subsequent VTY connections. Though it is not possible to establish new telnet, reverse telnet, RSH, SSH, SCP or HTTP connections to the device after a successful exploitation, the device is only vulnerable on TCP port 23 and the reverse telnet ports listed above. A successful exploitation of this vulnerability requires a complete 3-way TCP handshake, which makes it very difficult to spoof the source IP address. Only remote access services that use VTYs are affected. This includes telnet, reverse telnet, RSH, SSH, SCP and version 1.0 of the HTTP server. Other device services including, but not limited to, routing protocols, TACACS/RADIUS, Voice over IP (VoIP) and packet forwarding are not affected. This vulnerability is addressed by Cisco bug ID: * CSCef46191 ( registered customers only) To determine the software running on a Cisco product, log in to the device and issue the show version command to display the system banner. Cisco IOS software will identify itself as "Internetwork Operating System Software" or simply "IOS �". On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the IOS release name. Other Cisco devices will not have the show version command or will give different output. The following example identifies a Cisco product running IOS release 12.0(3) with an installed image name of C2500-IS-L: Cisco Internetwork Operating System Software IOS (TM) 2500 Software (C2500-IS-L), Version 12.0(3), RELEASE SOFTWARE The release train label is "12.0". The next example shows a product running IOS release 12.0(2a)T1 with an image name of C2600-JS-MZ: Cisco Internetwork Operating System Software IOS (tm) C2600 Software (C2600-JS-MZ), Version 12.0(2a)T1, RELEASE SOFTWARE (fc1) Additional information about Cisco IOS Banners is available at http://www.cisco.com/en/US/products/sw/iosswrel/ios_abcs_ios_networking_the…. Impact ====== Exploitation of this vulnerability may result in the denial of new telnet, reverse telnet, RSH, SSH, SCP and HTTP connections to a device running IOS. Other access to the device via the console or SNMP is not affected. The device will remain in this state until the problematic TCP connection is cleared, or the device is reloaded (which will clear the problematic session). If no other access methods are available, exploitation of this vulnerability could deny remote access to the device. Depending on your network architecture, workarounds may be available to mitigate this vulnerability. Software will be available to repair this vulnerability. Software Versions and Fixes =========================== Cisco is working to release fixes for this vulnerability in all currently maintained IOS releases. No software upgrade is required in order to mitigate this vulnerability. See the information below regarding the available configuration workarounds. The software fixes will appear in regularly scheduled maintenance releases of IOS software. As fixed software becomes available for public release, Cisco will update this section of the advisory. Obtaining Fixed Software ======================== Customers with Service Contracts - -------------------------------- As fixed software becomes available, customers with contracts should obtain the fixed software through their regular update channels. For most customers, this means that such software should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third-party Support Organizations - ------------------------------------------------- Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with the upgrade or fixed software, which should be free of charge. Customers without Service Contracts - ----------------------------------- Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their fixed software by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Please have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Please do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades. See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Workarounds =========== The effectiveness of any workaround is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Customers should consult with their service provider or support organization to ensure any applied workaround is the most appropriate for use in the intended network before it is deployed. Mitigation Strategies - --------------------- Not all of the mitigation strategies listed will work for all customers. Some of the workarounds listed are dependent on which versions and feature-sets of IOS you have in your network. Enabling SSH and disabling telnet - --------------------------------- Note: SSH support is only available in certain IOS feature sets and platforms Cisco devices that support SSH can enable it by following the steps listed here: http://cisco.com/en/US/products/sw/iosswrel/ps1835/products_configuration_g… To disable telnet access to the device, configure the following on all your VTY lines: Router(config)# line vty 0 4 Router(config-line)# transport input ssh Note: Even if SSH is enabled, the IOS device is not protected until telnet access is disabled. Configuring a VTY Access Class - ------------------------------ It is possible to limit the exposure of the Cisco device by applying a VTY access class to permit only known, trusted devices to connect to the device via telnet, reverse telnet, RSH, SSH or SCP. For more information on restricting traffic to VTYs, please consult: http://cisco.com/en/US/products/sw/iosswrel/ps1835/products_command_referen… Configuring Interface Access Lists (ACLs) - ----------------------------------------- In addition to configuring a VTY Access Class, it may be desirable to block all telnet traffic from entering the network. The example below demonstrates how to block TCP port 23 and the reverse telnet traffic while permitting all other IP traffic. Router(config)# access-list 100 deny tcp any any eq telnet Router(config)# access-list 100 deny tcp any any range 2001 2999 Router(config)# access-list 100 deny tcp any any range 3001 3099 Router(config)# access-list 100 deny tcp any any range 6001 6999 Router(config)# access-list 100 deny tcp any any range 7001 7099 Router(config)# access-list 100 permit ip any any The access list must then be configured to block inbound traffic on all public-facing interfaces: Router(config)# interface Ethernet 0/0 Router(config-if)# ip access-group 100 in Telnet should be blocked as part of a Transit ACL controlling all access to the trusted network. Transit ACLs are considered a network security best practice and should be considered as a long-term addition to good network security, as well as a workaround for this specific vulnerability. The white paper entitled "Transit Access Control Lists: Filtering at Your Edge" presents guidelines and recommended deployment techniques for transit ACLs: http://www.cisco.com/warp/public/707/tacl.html Configuring Infrastructure Access Lists (iACLs) - ----------------------------------------------- Although it is often difficult to block traffic transiting your network, it is possible to identify traffic which should never be allowed to target your infrastructure devices and block that traffic at the border of your network. Infrastructure ACLs are considered a network security best practice and should be considered as a long-term addition to good network security as well as a workaround for this specific vulnerability. The white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection ACLs: http://www.cisco.com/warp/public/707/iacl.html Configuring Receive Access Lists (rACLs) - ---------------------------------------- For distributed platforms, rACLs may be an option starting in Cisco IOS Software Versions 12.0(21)S2 for the 12000 series GSR and 12.0(24)S for the 7500 series. The receive access lists protect the device from harmful traffic before the traffic can impact the route processor. Receive path ACLs are considered a network security best practice, and should be considered as a long-term addition to good network security, as well as a workaround for this specific vulnerability. The CPU load is distributed to the line card processors and helps mitigate load on the main route processor. The white paper entitled "GSR: Receive Access Control Lists" will help identify and allow legitimate traffic to your device and deny all unwanted packets: http://www.cisco.com/warp/public/707/racl.html Exploitation and Public Announcements ===================================== The Cisco PSIRT is aware of exploitation of this vulnerability and is recommending customers take action to protect themselves. Status of This Notice: INTERIM ============================== THIS ADVISORY IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. YOUR USE OF THE INFORMATION ON THE ADVISORY OR MATERIALS LINKED FROM THE ADVISORY IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS NOTICE AT ANY TIME. CISCO EXPECTS TO UPDATE THIS NOTICE WITHIN 48 to 72 hours FROM THE ORIGINAL DATE OF THIS NOTICE. Distribution ============ This advisory will be posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20040827-telnet.shtml. In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-teams(a)first.org (includes CERT/CC) * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.netsys.com * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------------+ | Revision | 2004-August-27 | Initial public | | 1.0 | | release. | +---------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/warp/public/707/sec_incident_response.shtml. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQFBLxMAezGozzK2tZARAj6eAJ0VX9vmrTBin4Vxt3FchPLIddKAlQCgvt20 dDYTV+/GnsCSHsRfmUz5eJw= =1fzl -----END PGP SIGNATURE-----

1 0

On the back of other security posts (well some over a year ago now)....
by Matthew Sullivan 27 Aug '04

27 Aug '04

Need I say more...? http://www.securityfocus.com/news/9411 My thanks to those who listened and helped me. My thanks to those who helped Spamhaus, and my thanks to anyone else who got involved with the whole deal. / Mat

1 0

MRV discounts (summary)
by Deepak Jain 27 Aug '04

27 Aug '04

All folks seemed to think 20% was no trouble. One guy suggested 40% was possible on some equipment. Some vendors seemed to choke on that suggestion. :) DJ

2 1

Mega DOS tomorrow?
by Andy Dills 26 Aug '04

26 Aug '04

So, slashdot is linking to some news sites that are reporting that Aleksandr Gostev from Kapersky Labs in Russia has predicted that a large chunk of the net will be shut down tomorrow. I thought the ISC comment was pretty funny: http://isc.sans.org/diary.php -- e-Jihad Begins Thursday, Internet Predicted to Melt Down by Mid-day You should probably starting backing up that gig of gmail to local storage. According to a Russian news site, Kaspersky Labs states that terrorists will launch attacks which will paralyze the Internet this Thursday. This tragically coincides with two weeks of script kiddie attacks (which were scheduled to begin this past Sunday) aimed at disrupting the Republican national convention. In addition, many college students are back on campus this week, which provides the e-terrorists and i-subversives with a veritable candyland of insecure boxes on big pipes. Faced with this triple threat, our beloved Internet will surely fall. The ISC would like to go out on a limb and predict that the Internet will not vaporize into a cloud of nothingness this Thursday, but if it does, it's been our pleasure to help stave off its inevitable annihilation this long. -- Andy --- Andy Dills Xecunet, Inc. www.xecu.net 301-682-9972 ---

12 11

RE: Mega DOS tomorrow?
by Bill Jones 26 Aug '04

26 Aug '04

Can you hear me now? Good. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Chris Allermann Sent: Thursday, August 26, 2004 8:21 AM To: nanog(a)merit.edu Subject: RE: Mega DOS tomorrow? Can you hear me now? (I'm testing my verizon circuits ;-) ) On Thu, 2004-08-26 at 08:46, Jason Graun wrote: > Hello! Can anybody hear me?! This the Internet still there?! > > > Thanks > > > Jason :)

1 0

Fw: Kaspersky: Out of Context
by Matthew McGehrin 26 Aug '04

26 Aug '04

----- Original Message ----- From: "InfoSec News" <isn(a)c4i.org> To: <isn(a)attrition.org> Sent: Thursday, August 26, 2004 5:44 AM Subject: [ISN] 25th August 2004 > http://www.viruslist.com/eng/index.html?tnews=461517&id=2100900 > > 25th August 2004: Who knows what tomorrow will bring? > > A handful of sites are stating that Eugene Kaspersky, founder of > Kaspersky Labs, believes that tomorrow will bring a massive terrorist > attack on the Internet. This is being quoted in a range of ways, > ranging from factual reporting to citing the story as an example of > cyber hysteria. > > However, Kaspersky is not predicting the end of the Internet tomorrow > - or even in the near future. The story stems from brief comments made > yesterday at a press conference which was dedicated to cybercrime and > the problems of spam. > > At this press conference, Kaspersky commented that the possibility of > terrorists using the Internet as a tool to attack certain countries > was a reality. As an example, he cited the fact that a number of > Arabic and Hebrew language websites contained an announcement of an > 'electronic jihad' against Israel, to start on 26th August 2004. > > In an interview today, Kaspersky stressed that such information was > not necessarily trustworthy. 'We don't know who is behind these > statements.' He went on to clarify: 'It's not the first time the term > 'electronic jihad' has been used. We've seen this before, with the > focus being on sending racist emails, and defacing and hacking Israeli > web sites. But it is the first time I have seen sites encouraging the > use of Internet attacks against one country as a form of terrorism.' > > 'As we've already stated many times in the past, it would be easy > enough to use a network of infected computers to launch such an > attack. We saw the impact that Sasser, Mydoom and Slammer had, on the > Internet, businesses and organisations. Just imagine if such an attack > was directed at one country or one critical point in the > infrastructure of the Internet. Computers are a tool - and just like > any tool, they can be used or misused.' > > Kaspersky emphasised that the likelihood of a massive attack directed > against Israeli institutions tomorrow is low. However, he believes > that Pandora's box has now been opened. Hackers and virus writers can > be motivated by a range of factors: money, curiosity, or political > conviction. But whatever their motivation, the insecure nature of the > Internet and weak security precautions offer a wealth of > opportunities. 'Maybe it won't be tomorrow, or the day after tomorrow > - but sooner or later, terrorists will be using the Internet as > another weapon in their arsenal.'

1 0

Weirder issues ... resolved
by J. Oquendo 26 Aug '04

26 Aug '04

On Tue, 24 Aug 2004, Lane Patterson wrote: > Yes, you have experienced what is known in the field as "air gap > attenuation"--not something you want to depend on if you want a clean > link! A close relative is "knot-in-the-fiber attenuation". > > Your subject says "GigE Media converter" but you say you are deploying > an OC12. Which is it? Apologies. An OC12 was layed down, and I was running the drops from building to building. This is the exact deal of what happened (now that I can sit down for moment and think on a level head): I was setting up the fiber lines (multi mode already layed down) to connect the media converters to my switches. There are altogether about 8 buildings but for clarity I'll focus on the three which the event occurred... Building A - Main point Building B - about 1200 feet from Building A Building C - about 600 feet from Building A In Building A, I hooked up my media converter (Netgear) to Building B. Light was on, I had a signal going out. Walked over to Building B to hook up that media converter (Netgear) and this oddity occurred - link droppage when SC connector was fully plugged. Walked back over to Building A to replicate the incident, meaning I fully plugged Building B and wanted to see if I slightly pulled out Building A's SC if it would drop link. Sure enough it did. Now back in Building A, I took off Building C's media converter (Netgear) and swapped it with Building C which worked fine. Building C took Building B's media converter and pushed light with no problem. Now Building C is ALMOST twice as far as Building B is so if attenuation was the case, when I swapped out the media converters it should have done the same thing. Weirder was, everthing worked except I could not open the browser interface for the switches. At first I thought it was a VLAN issue so I walked back to the main building and added a port to have connectivity to every VLAN on the switch. Didn't work. So... One funky connection for a moment: Linked, pings out everywhere, could ssh everywhere, could do anything BUT open a browser throughout the entire Building B. Just bizarre. > Definitely invest in a light meter that can do the usual flavors > of single and multimode, connector types, and at least 850 and 1310nm > wavelengths. Then simply test strength of light on your receive port > on each side, compare to specifications of your equipment, and add > in-line attenuators as necessary. You'll usually find a range something > like -3 to -27 dBm, and we prefer -15 dBm as our ideal. Also, make > sure you've got the right type of fiber jumpers--mixing up single > (yellow) and multi (orange) mode fiber can cause similar issues. All in all it's up now. After playing switcharoonee with these silly little Netgears, they seemed to bork themselves into working. Thanks to all of the responses from everyone. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How can we account for our present situation unless we believe that men high in this government are concerting to deliver us to disaster?" Joseph McCarthy "America's Retreat from Victory"

1 0

RFC3834 -
by Stephen Stuart 26 Aug '04

26 Aug '04

For those who like to provide gentle reminders regarding mailing list etiquette to subscribers whose auto-responders reply to mail sent to lists (rather than only replying when the recipient is specifically named), there is now a standards-track RFC that you can reference to reinforce that such responses SHOULD NOT be issued: RFC 3834 Recommendations for Automatic Responses to Electronic Mail Get it from your favorite RFC repository, such as: ftp://ftp.rfc-editor.org/in-notes/rfc3834.txt Stephen

1 0

Anybody at ATT.net email services?
by Vish Yelsangikar 26 Aug '04

26 Aug '04

We're having trouble with ATT delaying our email. They are using a "grey-listing" technique to filter spam. Their mail servers give a "deferred" message and ask you to resend your email two hours later. The mail is allowed through on the retry. This filters out most spam, because most spam engines ignore return codes and will not retry. This is causing problems, because our mail servers are getting all clogged up with email to att.net customers and slowing down. Our difficulty has been in finding someone at AT&T to speak with about this. Can somebody from ATT.net help Netflix? Thanks Vish.

2 1

RE: Toplayer
by Hosman, Ross 25 Aug '04

25 Aug '04

More specifically I'm looking for someone who used/uses attack mitigator IPS 5000 series equipment in a production environment (not in a test lab) -----Original Message----- From: owner-nanog(a)merit.edu Sent: Wednesday, August 25, 2004 8:06 AM To: 'nanog(a)merit.edu' Subject: Toplayer Can someone that works with toplayer equipment please contact me off the list. Ross Hosman HSD Administrator ross.hosman(a)chartercom.com

1 0