RE: Cisco IOS Denial of Service that affects most Cisco IOS routers- requires power cycle to recover

From: James Fields (jvfieldsat_private)
Date: Fri Jul 18 2003 - 11:51:31 PDT

  • Next message: morning_wood: "Re: Need some help and guidance, please....RE: TROJAN: Symantec: New Serious Virus found. (fwd)"

    On Fri, 2003-07-18 at 01:30, Tina Bird wrote:
    
    
    > information on the detailed structure of the evil packets in these
    > protocols is not yet public AFAIK.
    > 
    
    No detailed structure needed.  Just a sequence of packets (any of the
    protocols will do, 103 will only work if PIM is enabled on the router)
    in sufficient quantity.  For example, 75 packets targeting a router
    using protocol 53, 55, or 77 will do it on most routers where the input
    queue defaults to 75.  Yes, I've been playing this morning, I got 6
    engineers sitting around my desk while we tied to figure out the
    "special sequence" - that's a joke, no special sequence required.
    -- 
    James V. Fields
    
    
    ----------------------------------------------------------------------------
    Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the 
    world's premier technical IT security event! 10 tracks, 15 training sessions, 
    1,800 delegates from 30 nations including all of the top experts, from CSO's to 
    "underground" security specialists.  See for yourself what the buzz is about!  
    Early-bird registration ends July 3.  This event will sell out. www.blackhat.com
    ----------------------------------------------------------------------------
    



    This archive was generated by hypermail 2b30 : Fri Jul 18 2003 - 13:07:05 PDT