RE: Code red II crashes cisco 678

From: Vladimir Kraljevic (vladimir_kraljevicat_private)
Date: Mon Aug 06 2001 - 08:54:56 PDT

  • Next message: Petruzel, Oliver: "RE: CR II - winME? confirmation?"

    I've had problems with Cisco 677 (please take a search for
    20000814172811.28516.qmailat_private).
    
    It was possible to smash the router (only power off helped) by issuing ICMP
    echo with record route flag set (succeeded even with Win32 ping from command
    line). Problem appeared after several echo requests of that type, not
    immediately (try ping -t -r 8 <some.non.local.ip.address> and wait 2-3
    minutes at most). However, I was not able (not enough time, as usual) to try
    to craft fake ICMP response with recorded routes inside (maybe this allows
    an DoS against complete families of Cisco 6xx routers).
    
    Maybe related.
    
    Vladimir
    
    
    C:\>-----Original Message-----
    C:\>From: Geo. [mailto:georgerat_private]
    C:\>Sent: Monday, August 06, 2001 4:43
    C:\>To: Russ; VULN-DEVat_private;
    C:\>NTBUGTRAQat_private;
    C:\>Discussion regarding Windows-related security vulnerabilities and
    C:\>risks.; Marc Maiffret; securityat_private
    C:\>Subject: Code red II crashes cisco 678
    C:\>
    C:\>
    C:\>All day I've had customers calling with cisco 678 routers
    C:\>running cbos 2.4.2
    C:\>with the web interface disabled. Seems their routers have
    C:\>been crashing.
    C:\>
    C:\>We traced this back to the code red worm. For some reason
    C:\>even with web
    C:\>disabled on these routers port 80 remains open. Simply
    C:\>running a port scan
    C:\>and cutting off the connection is enough to crash the
    C:\>router. Locks up
    C:\>solid.
    C:\>
    C:\>I also found a solution, by doing a
    C:\>
    C:\>set web remote ipaddress
    C:\>
    C:\>where ipaddress is one of their internal IP's you can
    C:\>prevent outside
    C:\>addresses from being able to crash the router.
    C:\>
    C:\>Just a heads up guys, if you are seeing 678's crashing,
    C:\>give it a try, it's
    C:\>working here.
    C:\>
    C:\>Geo.
    C:\>
    C:\>
    C:\>
    C:\>
    



    This archive was generated by hypermail 2b30 : Mon Aug 06 2001 - 10:41:20 PDT