Skip to Content

Security

Cisco IP Phone Vulnerability Enables Remote Eavesdropping

Thu, 2013-01-10 23:20

A recent Cisco Security Advisory details a vulnerability that allows "an arbitrary code execution...that could allow a local attacker to execute code or modify arbitrary memory with elevated privileges." In other words, if you have a Cisco 7900 series IP Phone on your desk, it can be totally pwnd.

This might not come as a surprise to those who have worked with these devices or other IP phones with programmable features. It's basically a little computer with a plastic phone shaped box wrapped around it. If this is a surprise to you or if you don't believe it, check out the video demonstration below.

Password Recovery on a Cisco 2500 Series Router

Wed, 2012-07-11 07:00
Command Line

If you have built a home lab (or are running really ancient hardware in production), you may find yourself in need of resetting the password configured on a 2500 series router. Depending on the router platform, the syntax is different. Here's how to do it on a 2500:

1. Reboot the router and send a break sequence to enter ROMMON mode. Break sequences can be sent using a Ctrl+Break key combination, or if you are on a system that doesn't have a break sequence, try using your terminal software to send a break sequence.

2. (optional) Type the letter O and hit enter. Record the existing setting, it's most likely 0x2102.

3. To reset the configuration register and have the router bypass the startup-config, type the following:

o/r 0x2142

To boot the router, type the letter i and hit enter.

Cisco Security Advisory - NX-OS Denial of Service Vulnerability

Sat, 2012-03-10 09:36

Cisco recently announced a vulnerability in their NX-OS for the 1000v, 5000, and 7000 platforms. If you are running Nexus in your network, be sure to check this one out because it could cause an outage.

In order for this vulnerability to be exploited (or randomly occur), a malformed IP packet has to enter into the Nexus and one of several conditions can trigger the problem. The advisory notes provide a few examples of how to trigger the problem including the following: a malformed packet with a TTL value of 1 that would cause the Nexus to send an ICMP time exceeded error message. The process of generating the ICMP message could trigger the bug.

What's Vulnerable and How do I fix it?

Here's a list of the versions with the vulnerability and the version with the fix, per platform:

Cisco Security Advisory - IKE Resource Exhaustion Attack

Thu, 2011-11-03 06:57

If you have ever setup an IPSEC VPN, then you are most likely aware of IKE. IKE is a protocol that can be used to get the first phase of an IPSEC VPN established, a.k.a exchange keys. Well, Cisco has identified a vulnerability in the IKE implementation on Cisco platforms thanks to the work of Roy Hills from NTA Monitor Ltd that could allow a malicious individual to unleash a denial of service on your VPN devices.

What's Vulnerable

Essentially, if your Internet facing VPN devices or border routers
allow anyone on the planet to establish an IKE session with your Cisco
VPN devices (Cisco 3000 VPN Concentrator, Pix, ASA, ISR, etc), then you
are vulnerable.

The issue is pretty much present in anything that supports IPSEC VPNs and doesn't explicitly filter traffic to the VPN devices. Cisco is tracking the issue in the following bug ID's:

Check Point 61000 Security System

Mon, 2011-10-24 07:46


If you need a massive amount of firewall power, check out the Check Point 61000. This thing looks like a modular switch chassis, but it's a firewall that runs all of Check Point's latest and greatest software. 

Officially announced in August of this year, the 61,000 is aimed at the largest of customers such as service providers or hosted solutions providers. The system is capable of pushing 200Gbps of filtered traffic and sports a Check Point Security Power rating of up to 14,000. If you are unfamiliar with the security power rating, it is a number that Check Point comes up with to try to quantify all the variables a security device can do using security power units (SPUs). Think of a small branch firewall providing a couple hundred SPUs and an enterprise edge firewall providing 500-2000 SPUs. So, 14,000 is a lot.

Let the IPv6 Vulnerabilities Begin

Mon, 2011-10-03 06:36

Cisco last week released a slew of security advisories. One that specifically caught my eye is a Denial of Service vulnerability due to "improper processing of malformed IP version 6 (IPv6) packets by Cisco IOS Software."

I've been wondering how long it would take for the exploits to start to trickle in with IPv6. One can only imagine how many vulnerabilities Windows will have with IPv6 enabled by default. Expect to see more of these in the future as IPv6 becomes more prevalent.

The alert details are available here.

The vulnerability details are available here.

How to configure an IPv4 GRE tunnel to carry IPv6 traffic

Mon, 2011-09-12 08:03

Continuing the review of the TSHOOT Topology, on the IPv6 network map there is a GRE tunnel that is configured between Router 3 and Router 4. This tunnel is in place to allow IPv6 traffic to traverse the 10.1.1.8/30 IPv4 network. So, while reviewing the IPv6 tshoot topology, I decided to try out the tunnel configuration.

There are several ways to configure tunnels to allow IPv6 traffic to traverse IPv4 networks (and vice versa). This post will be focusing on a GRE tunnel configuration. If you want to review the other ways to create tunnels, i.e.  Automatic IPv4-Compatible IPv6 Tunnels, IPv6 Rapid Deployment Tunnels, and Automatic 6to4 Tunnels, I've included a link below to a great resource on Cisco's website that shows some great examples of other tunnels.

I threw together the following network diagram to provide a visual of what we are configuring: 

IPv6_GRE_Tunnel2

Free Cisco Press Chapter - Configuring Policies, Inheritance, and Attributes

Mon, 2011-08-29 22:30

Studying for your CCNP Security? If you are, or if you simply want to learn more about VPNs, take a look at this free chapter from Cisco Press on Configuring Policies, Inheritance, and Attributes.

This is straight out of the CCNP Security VPN 642-647 Official Cert Guide. According to Cisco Press, the chapter covers the following topics:

  • Policies and Their Relationships
  • Understanding Connection Profiles
  • Understanding Group Policies
  • Configure User Attributes
  • Using External Servers for AAA and Policy Assignment

Give it a read if you got your certification cross-hairs fixed on the CCNP Security.

Microsoft Patch Tuesday - August 2011

Tue, 2011-08-09 15:53

Our Redmond friends have released a bundle of new patches for their products today. Several patches address remote code execution vulnerabilities, even for more recent OS/browser combos such as win 7 64/-bit and IE9. Recommend updating to avert pwnage.

Check out the official bulletin for more details.

Configuring Clientless SSL VPN (WebVPN) on Cisco IOS Routers

Fri, 2011-08-05 00:19

A Tekcert member recently posted a question in the forums regarding IOS Clientless SSL VPN, a.k.a WebVPN. This prompted me to test the functionality in a lab environment and post my findings. To make it easier to find, I decided to make it a full-blown blog post. So, here we go...

The first step I took was to get a router with 12.4T code running on a LAN with a desktop connected to it. The following configuration is broken into chunks to help break down the process.

Configure basic settings on the router, including hostname, domain, usernames, etc. (not all of this is required for WebVPN to work, but it is what I had on my router so you're getting it all):

Stop Rogue DHCP Servers with DHCP Snooping

Wed, 2011-07-20 00:02

Protecting your network can be a daunting task. There are so many attack vectors to keep an eye on;  it is literally a full time job (and a certification track) to learn how to thwart evil doers. So, today we're going to take a look at one of those attack vectors - man in the middle using a rogue DHCP server. Then we're going to focus on how to stop those attacks dead in their tracks. 

ISC BIND 9 Remote packet Denial of Service Vulnerability

Tue, 2011-07-05 17:25

The Internet Systems Consortium has announced a vulnerability present in several versions of BIND 9.x. The description of the vulnerability from their site is as follows:

A defect in the affected BIND 9 versions allows an attacker to remotely
cause the "named" process to exit using a specially crafted packet. This
defect affects both recursive and authoritative servers. The code
location of the defect makes it impossible to protect BIND using ACLs
configured within named.conf or by disabling any features at
compile-time or run-time.

Versions affected are 9.6.3, 9.6-ESV-R4, 9.6-ESV-R4-P1, 9.6-ESV-R5b1, 9.7.0, 9.7.0-P1, 9.7.0-P2, 9.7.1, 9.7.1-P1, 9.7.1-P2, 9.7.2, 9.7.2-P1, 9.7.2-P2, 9.7.2-P3, 9.7.3, 9.7.3-P1, 9.7.3-P2, 9.7.4b1, 9.8.0, 9.8.0-P1, 9.8.0-P2, 9.8.0-P3, 9.8.1b1

Cisco Security Advisories - AnyConnect Client and 7900 Series Phones

Wed, 2011-06-08 07:10

Cisco release a couple severe security advisories last week that are worth taking a look at if you use either the Cisco AnyConnect Secure Mobility Client software or Cisco 7900 Series IP Phones. I'll try to break them down in english below to help you see if you are vulnerable.

Cisco Wireless LAN Controller DoS Vulnerability

Mon, 2011-05-02 21:40

Cisco has released a security advisory for a vulnerability in some of their Wireless LAN Controllers (WLCs) which if exploited can cause the device to reload. This doesn't affect very many of their wireless controllers, but this is a serious enough vulnerability to warrant a code upgrade if you are running an affected code version on an impacted platform. 

What Platforms Are Affected?

This vulnerability affects Cisco WLC software versions 6.0 and later. The following products are affected by the vulnerability described in this Security Advisory:

ASA5510 to ASA5505 Easy VPN Server / Client Configuration Sample

Thu, 2011-03-17 15:12

A recent configuration of mine...thought I would save the template for
future use. Useful if the ASA5505 has a dynamic IP where you can't build
a typical site-to-site VPN.

Syndicate content


Dr. Radut