[Full-Disclosure] Exploit for Multiple Cisco Vulnerabilities Released

[Cisco Systems Product Security Incident Response Team <psirt@xxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Proof-of-concept code has been publicly released that exploits multiple
previous vulnerabilities in various Cisco products.  The following
list of vulnerabilities taken verbatim from the exploit code are
affected.  Included after each is a URL which may be referenced for more
information regarding each vulnerability where Cisco has previously
released a security advisory or response to address the issue.  Customers
should take steps to ensure that they have addressed each of these
either via a software upgrade or workarounds in place as appropriate in
order to mitigate any risk from this new exploit code.


[1] - Cisco 677/678 Telnet Buffer Overflow Vulnerability

CBOS - Improving Resilience to Denial-of-Service Attacks
http://www.cisco.com/warp/public/707/CBOS-DoS.shtml


[2] - Cisco IOS Router Denial of Service Vulnerability

Cisco IOS HTTP Server Vulnerability
http://www.cisco.com/warp/public/707/ioshttpserver-pub.shtml


[3] - Cisco IOS HTTP Auth Vulnerability

IOS HTTP Authorization Vulnerability
http://www.cisco.com/warp/public/707/IOS-httplevel-pub.html


[4] - Cisco IOS HTTP Configuration Arbitrary Administrative Access Vulnerability

IOS HTTP Authorization Vulnerability
http://www.cisco.com/warp/public/707/IOS-httplevel-pub.html


[5] - Cisco Catalyst SSH Protocol Mismatch Denial of Service Vulnerability

Cisco Catalyst SSH Protocol Mismatch Vulnerability
http://www.cisco.com/warp/public/707/catalyst-ssh-protocolmismatch-pub.shtml


[6] - Cisco 675 Web Administration Denial of Service Vulnerability

Cisco is currently researching this vulnerability further.   Mitigation
methods have been available for some time such as setting the web server
to listen on a different port:

"Code Red" Worm - Customer Impact
http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub.shtml#workarounds

and through bugs resolved in the following advisory where the webserver
under Cisco CBOS was enabled by default and listening on port 80 even 
when the web server was not configured.

CBOS Web-based Configuration Utility Vulnerability
http://www.cisco.com/warp/public/707/cisco-cbos-webserver-pub.shtml


[7] - Cisco Catalyst 3500 XL Remote Arbitrary Command Vulnerability

Catalyst 3500 Issue
Report: http://www.securityfocus.com/archive/1/141471
Cisco Response: http://www.securityfocus.com/archive/1/144655


[8] - Cisco IOS Software HTTP Request Denial of Service Vulnerability

Cisco IOS HTTP Server Query Vulnerability
http://www.cisco.com/warp/public/707/ioshttpserverquery-pub.shtml


[9] - Cisco 514 UDP Flood Denial of Service Vulnerability

A Vulnerability in IOS Firewall Feature Set
http://www.cisco.com/warp/public/707/IOS-cbac-dynacl-pub.shtml



This issue regarding the publication of new exploit code was first 
reported to Cisco by the NCC/Telecom-ISAC who also contributed to the 
content of this notice.



-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.2

iQA/AwUBQGSDg3sxqM8ytrWQEQLD0QCeMqpkXFBUEfZfGKZUCO0zNSzyOgYAoK3f
kgGyWJb/UaRTyvwbP4blfLtN
=oGRt
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html