the ones having a looking-glass sending regexp commands to a cisco router should disable it ASAP.
Some specific regexp simply crash the router.
the regexp is available upon request (I will only answer to people I know)
---
lab-router#show ip bgp regexp <xxxxxx>
08:22:00 UTC Thu Sep 13 2007: TLB (load or instruction fetch) exception, CPU signal 10, PC = 0x4292C268
-------------------------------------------------------------------- Possible software fault. Upon reccurence, please collect crashinfo, "show tech" and contact Cisco Technical Support. --------------------------------------------------------------------
-Traceback= 4292C268 4292C428 4292C4A8 4292C470 4292C428 4292C4A8 4292C470 4292C428 4292C4A8 4292C470 4292C428 4292C4A8 4292C470 4292C428 4292C4A8 4292C470 $0 : 00000000, AT : 00000050, v0 : 454A0000, v1 : 60B0B650 a0 : D83CD540, a1 : D83CD53C, a2 : 60F96210, a3 : 454A0000 t0 : 00000002, t1 : 00000000, t2 : 00000000, t3 : FFFF00FF t4 : 42770408, t5 : 2C000000, t6 : 7C000000, t7 : 00000000 s0 : 60B0B6BE, s1 : 60B0B6C4, s2 : 454A0000, s3 : 454A0000 s4 : 454A0000, s5 : 454A0000, s6 : 60B0B6C9, s7 : 00000001 t8 : 04000000, t9 : 3C000000, k0 : 540C69C4, k1 : 41288F7C gp : 43C7A338, sp : 4549F850, s8 : 454A0000, ra : 4292C034 EPC : 4292C268, ErrorEPC : 424F295C, SREG : 3400FF03 MDLO : 00000000, MDHI : 00000008, BadVaddr : D83CD540 DATA_START : 0x4370ACD0 Cause 00000008 (Code 0x2): TLB (load or instruction fetch) exception
Hello Pascal
Pascal Gloor wrote:
the ones having a looking-glass sending regexp commands to a cisco router should disable it ASAP.
I think I already had read about this somewhere else in the last few weeks.
Ok, found it (did not find it in the Bugtraq or Full-Discolsure mailing lists), Google pointed me to "Cisco IOS Show IP BGP Regexp Remote Denial of Service Vulnerability" [1], and the reference there points to a Heise article (which seems to be the main source). It has been published on the 17. August 2007, see the "DoS vulnerability in Cisco IOS compromises Internet routers [Update]" (English) [2] or "DoS-Lücke in Cisco IOS gefährdet Router der Internet Provider [Update]" (German) [3].
[1] http://www.securityfocus.com/bid/25352 [2] http://www.heise-security.co.uk/news/94526/ [3] http://www.heise.de/newsticker/meldung/94517/
bye Fabian
Am 13.09.2007 um 10:41 schrieb Pascal Gloor:
the ones having a looking-glass sending regexp commands to a cisco router should disable it ASAP.
Some specific regexp simply crash the router.
the regexp is available upon request (I will only answer to people I know)
You mean there is something newer than
barf# show ip bgp regexp (.*)(_\1)+
which will do bad things to your router? That ones was published almost a month ago.
Cheers, -daniel
-
Daniel G. Kluge -
Fabian Wenk -
Pascal Gloor