4 ms·
I've read through the description and now the whitepaper and I've got a few takeaways. 1. These attacks can't be carried out over the internet, you need local
by bifrost 7y ago
I've read through the description and now the whitepaper and I've got a few takeaways.
1. These attacks can't be carried out over the internet, you need local access. Thats easier than you'd think with employees with unsecured laptops/vms/etc.
2. The exploit(s) appears to be RCE in the OS that runs on the device, but not neccesarily translating into executing configuration commands on the control plane. But its not a big leap to make configuration changes...
3. The DoS case doesn't seem great either but also requires local access.
4. The string format bug has the most entertainment value for me -> You can spew CDP packets into a switch/device which potentially overwrite other devices CDP data, which means you could potentially issue a poweroff or change the name of said device.
5. The phone vulnerability is good too -> If you can broadcast/spew CDP from your host, you can be annoying to phones.
6. The cameras can only be harassed by plugging directly into it, rendering the vuln somewhat useless.
My takeaway is that you can't easily escalate vlan privileges via CDP which is good, but you can def monkey with the controlplane and maybe someone will come up with a way to change the IOS configuration.
- Cyph0n 7y agoThe NX-OS video shows a demo where the attacker remotely enables the management IP and uses that to reconfigure the Nexus switch.
- bifrost 7y agoI guess thats what I get for not watching the video and only reading the PDF. That said "enabling the management ip" is unlikely to happen since most people put the management IP on OOB and ACL where you can access it from; the exploit is unlikely to be able to change ACLs.
- Hikikomori 7y agoIf you can enable it you can change other config like ACLs as well.
- fulafel 7y agoThey can be carried over the internet: VPN vulnerabilities are pretty common, eg https://www.us-cert.gov/ncas/current-activity/2019/07/26/vulnerabilities-multiple-vpn-applications https://www.us-cert.gov/ncas/current-activity/2019/07/26/vul... VPNs commonly bridge at layer 2, that's a direct path to pwnage in this case.