3 ms·

> when a tunnel interface is manually configured on the device using tunnel mode ipip and appropriate tunnel source and tunnel destination. The device is not ex

by zokier 6y ago

> when a tunnel interface is manually configured on the device using tunnel mode ipip and appropriate tunnel source and tunnel destination. The device is not expected to decapsulate and process any IP in IP traffic that is not destined to such a tunnel interface. > This vulnerability causes an affected device to unexpectedly decapsulate and process IP in IP packets that are destined to a locally configured IP address, even when no tunnel configuration is present. Any input ACL configured on an inbound interface of the affected device is evaluated against the IP fields on the carrier IP packet prior to decapsulation; it would not be evaluated on the passenger IP packet. > Under specific conditions, processing of a crafted IP in IP packet could cause the network stack process to crash on an affected device. Ummmmm.... This sounds embarrasingly bad for Cisco. The crash DoS is just a cherry on top. But failing to filter tunneled packets is bit of a wtf, especially if you don't even have tunneling configured. And despite this being marked as generic vuln, the gist really seem to be just squarely a Cisco implementation fault.

barbegal 6y ago
It seems it is not just Cisco, some printers are vulnerable too. I don't know why you would ever need IP in IP on a printer
- eyalitki 6y ago
  The printers get it from treck (HP OfficeJet and LaserJet use it), which probably means that other clients of this TCP/IP stack will be vulnerable as well. Although I can't figure out why this feature should be "on-by-default" in treck, as most clients probably don't need it activated.
  - jandrese 6y ago
    If it were off the UI designers would have to add it to the configuration system of the printer for that 0.1% of (corporate VIP) users who need it. That's something that seems to be a big ask for printer manufacturers. Even something like a SNMP MIB you can write to is a bridge too far.
- tyingq 6y ago
  Printing to printers that are behind NAT, I suppose. It appears the higher end JetDirects do Ipsec.

by zokier 6y ago

barbegal 6y ago

It seems it is not just Cisco, some printers are vulnerable too. I don't know why you would ever need IP in IP on a printer

eyalitki 6y ago
The printers get it from treck (HP OfficeJet and LaserJet use it), which probably means that other clients of this TCP/IP stack will be vulnerable as well. Although I can't figure out why this feature should be "on-by-default" in treck, as most clients probably don't need it activated.
- jandrese 6y ago
  If it were off the UI designers would have to add it to the configuration system of the printer for that 0.1% of (corporate VIP) users who need it. That's something that seems to be a big ask for printer manufacturers. Even something like a SNMP MIB you can write to is a bridge too far.
tyingq 6y ago
Printing to printers that are behind NAT, I suppose. It appears the higher end JetDirects do Ipsec.