Cisco IOS HTTP %% Vulnerability

Bugtraq ID:	1154
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 26 2000 12:00AM
Updated:	Apr 26 2000 12:00AM
Credit:	This vulnerability was posted to the Bugtraq mailing list by Keith Woodworth <[email protected]> on April 26, 2000.
Vulnerable:	Cisco IOS 12.0.7 Cisco IOS 12.0.6 Cisco IOS 12.0.5 Cisco IOS 12.0.4 T Cisco IOS 12.0.4 S Cisco IOS 12.0.4 Cisco IOS 12.0.3 T2 Cisco IOS 12.0.2 XG Cisco IOS 12.0.2 XF Cisco IOS 12.0.2 XD Cisco IOS 12.0.2 XC Cisco IOS 12.0.2 Cisco IOS 12.0.1 XE Cisco IOS 12.0.1 XB Cisco IOS 12.0.1 XA3 Cisco IOS 12.0.1 W Cisco IOS 11.3.1 T Cisco IOS 11.3.1 ED Cisco IOS 11.3.1 Cisco IOS 11.2.10 BC Cisco IOS 11.2.10 Cisco IOS 11.2.9 XA Cisco IOS 11.2.9 P Cisco IOS 11.2.8 P Cisco IOS 11.2.8 Cisco IOS 11.2.4 F1 Cisco IOS 12.0T Cisco IOS 12.0S Cisco IOS 12.0DB Cisco IOS 12.0(9)S Cisco IOS 12.0(8) Cisco IOS 12.0(7)T Cisco IOS 12.0(5)T1 Cisco IOS 12.0 Cisco IOS 11.3T Cisco IOS 11.3 Cisco IOS 11.2P Cisco IOS 11.2(17) Cisco IOS 11.2 Cisco IOS 11.1
Not Vulnerable:	Cisco IOS 11.2.8 SA1 Cisco IOS 12.1(1a)T1 Cisco IOS 12.1(1.3)T Cisco IOS 11.0

Cisco IOS HTTP %% Vulnerability

A denial of service attack exists in versions of Cisco IOS, running on a variety of different router hardware. If the router is configured to have a web server running for configuration and other information a user can cause the router to crash.

Cisco IOS HTTP %% Vulnerability

The following example has been provided:

http://<router-ip>/%%

A proof of concept exploit has also been released to exploit this and other issues:

• /data/vulnerabilities/exploits/ciscoMultipleVulnsExploit.pl

Cisco IOS HTTP %% Vulnerability

Solution:
Cisco has released patches for this issue. For version and retreival information, see the advisory in the credit section.

Cisco IOS HTTP %% Vulnerability

References:

• Cisco Product Security Incident Response (Cisco Systems)
  
• Cisco Security Advisory: Cisco IOS HTTP Server Vulnerability (Cisco)