Re: IOS exploit: please disclose vehicle, not mechanism

Article View: comp.dcom.sys.cisco

Article #2261

Back to comp.dcom.sys.cisco Previous Next

#2261

From: Adrian Jensen
Date: Fri, 25 Jul 2003 01:27

26 lines
2916 bytes

fugi wrote:
[snip]
> 
> no it doesn't, my code I posted on the day the advisory came out
> at 11:30pm was abused by someone who got it from a friend that
> wasn't supposed to give it away. hence the sending via PGP and the
> sentence "don't distribute this". mine calculated the ttl to send
> in the packet with a traceroute, and there was a field for "ttl
> padding". a number that represented a negative and positive offset
> to add accountability for the oops factor. that's what I get for
> writing user friendly code.
> 
> 

Oh yah? Your "[L0cK]"??? Your description doesn;t match the code I saw, 
it was not PGP signed, did not have a "do not distribute" message, and 
you have to calculate the TTL (with a ping according to the comment), it 
doesn't do it for you.

Adrian



-----= Posted via Newsfeeds.Com, Uncensored Usenet News =-----
http://www.newsfeeds.com - The #1 Newsgroup Service in the World!
-----==  Over 80,000 Newsgroups - 16 Different Servers! =-----

Technical Details

Message-ID: <3F208774.7000502@hotmail.com>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!nntp.cs.ubc.ca!cyclone.bc.net!news-out.superfeed.net!local!corp.newsgroups.com!not-for-mail

References:

<Xns93C1BACF3C55Awdjohnstoncomcastnet@206.127.4.25> <LqFTa.116237$wk6.30285@rwcrnsc52.ops.asp.att.net> <nnITa.64552$R92.35099@news2.central.cox.net> <3F1FF243.7010205@hotmail.com> <vi0c96s4g7c87a@corp.supernews.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,536b22101f44acbf
X-Google-Attributes: gidf922c,public
X-Google-Thread: 114395,536b22101f44acbf
X-Google-Attributes: gid114395,public
X-Google-Thread: 102702,536b22101f44acbf
X-Google-Attributes: gid102702,public
X-Google-ArrivalTime: 2003-07-24 23:39:47 PST
Message-ID: <3F208774.7000502@hotmail.com>
Date: Thu, 24 Jul 2003 18:27:16 -0700
From: Adrian Jensen <ad_jensen@hotmail.com>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.9) Gecko/20020513
X-Accept-Language: en-us, en
MIME-Version: 1.0
Newsgroups: comp.dcom.sys.cisco,ios.general,comp.security.firewalls
Subject: Re: IOS exploit: please disclose vehicle, not mechanism
References: <Xns93C1BACF3C55Awdjohnstoncomcastnet@206.127.4.25> <LqFTa.116237$wk6.30285@rwcrnsc52.ops.asp.att.net> <nnITa.64552$R92.35099@news2.central.cox.net> <3F1FF243.7010205@hotmail.com> <vi0c96s4g7c87a@corp.supernews.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 69.9.25.144
X-Trace: corp.newsgroups.com 1059115192 69.9.25.144 (25 Jul 2003 01:39:52 -0500)
Lines: 26
X-Comments: This message was posted through Newsfeeds.com
X-Comments2: IMPORTANT: Newsfeeds.com does not condone, nor support,  spam or any illegal or copyrighted postings.
X-Comments3: IMPORTANT: Under NO circumstances will postings containing illegal or copyrighted material through this service be tolerated!!
X-Report: Please report illegal or inappropriate use to <abuse@newsfeeds.com>
X-Abuse-Info: Please be sure to forward a copy of ALL headers, INCLUDING the body (DO NOT SEND ATTACHMENTS)
Organization: Newsfeeds.com http://www.newsfeeds.com 100,000+ UNCENSORED Newsgroups.
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!nntp.cs.ubc.ca!cyclone.bc.net!news-out.superfeed.net!local!corp.newsgroups.com!not-for-mail

Reply to Parent Message