Article View: comp.dcom.sys.cisco
Article #2263Re: IOS exploit: please disclose vehicle, not mechanism
From: fugi
Date: Fri, 25 Jul 2003 17:16
Date: Fri, 25 Jul 2003 17:16
38 lines
2798 bytes
2798 bytes
In comp.dcom.sys.cisco Adrian Jensen <ad_jensen@hotmail.com> wrote: > fugi wrote: > [snip] >> >> no it doesn't, my code I posted on the day the advisory came out >> at 11:30pm was abused by someone who got it from a friend that >> wasn't supposed to give it away. hence the sending via PGP and the >> sentence "don't distribute this". mine calculated the ttl to send >> in the packet with a traceroute, and there was a field for "ttl >> padding". a number that represented a negative and positive offset >> to add accountability for the oops factor. that's what I get for >> writing user friendly code. >> >> > Oh yah? Your "[L0cK]"??? Your description doesn;t match the code I saw, > it was not PGP signed, did not have a "do not distribute" message, and > you have to calculate the TTL (with a ping according to the comment), it > doesn't do it for you. > Adrian no I'm not. you do realize there were like 20 different people who posted code for it. and for the TTL setting... ok I think even a script kiddie can do a traceroute. however they may pound a router for an hour with it looping because it's not going down because they never checked to see if the route was filtered. otherwise, hping,sendip,packet, and other system tools are good for script kiddies too. not all that complicated... > -----= Posted via Newsfeeds.Com, Uncensored Usenet News =----- > http://www.newsfeeds.com - The #1 Newsgroup Service in the World! > -----== Over 80,000 Newsgroups - 16 Different Servers! =----- -- The complexity of a weapon is inversely proportional to the IQ of the weapon's operator.
Technical Details
Message-ID:
<vi2pf3n4185r2e@corp.supernews.com>Path:
arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!sn-xit-03!sn-xit-06!sn-post-01!supernews.com!corp.supernews.com!not-for-mailReferences:
<Xns93C1BACF3C55Awdjohnstoncomcastnet@206.127.4.25> <LqFTa.116237$wk6.30285@rwcrnsc52.ops.asp.att.net> <nnITa.64552$R92.35099@news2.central.cox.net> <3F1FF243.7010205@hotmail.com> <vi0c96s4g7c87a@corp.supernews.com> <3F208774.7000502@hotmail.com>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,536b22101f44acbf
X-Google-Attributes: gidf922c,public
X-Google-Thread: 114395,536b22101f44acbf
X-Google-Attributes: gid114395,public
X-Google-Thread: 102702,536b22101f44acbf
X-Google-Attributes: gid102702,public
X-Google-ArrivalTime: 2003-07-25 10:16:20 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!sn-xit-03!sn-xit-06!sn-post-01!supernews.com!corp.supernews.com!not-for-mail
From: fugi <fugi@ultra.bl.org>
Newsgroups: comp.dcom.sys.cisco,ios.general,comp.security.firewalls
Subject: Re: IOS exploit: please disclose vehicle, not mechanism
Date: Fri, 25 Jul 2003 17:16:19 -0000
Message-ID: <vi2pf3n4185r2e@corp.supernews.com>
References: <Xns93C1BACF3C55Awdjohnstoncomcastnet@206.127.4.25> <LqFTa.116237$wk6.30285@rwcrnsc52.ops.asp.att.net> <nnITa.64552$R92.35099@news2.central.cox.net> <3F1FF243.7010205@hotmail.com> <vi0c96s4g7c87a@corp.supernews.com> <3F208774.7000502@hotmail.com>
User-Agent: tin/1.4.6-20020816 ("Aerials") (UNIX) (NetBSD/1.6.1 (i386))
X-Complaints-To: abuse@supernews.com
Lines: 38