Security and Vulnerability Analysis of an Ethernet-based attack on Cisco IOS

We note the recent attack on Cisco routers, publicized in July 2003, and analyze this work and expand upon it. This exploit used crafted packets to overflow the input buffer on Cisco devices and caused a Denial of Service, making the device unavailable for legitimate users, leading to loss of network connectivity. Cisco has provided a patch for this vulnerability. A test regimen was developed by the author, utilizing two Cisco routers (at once) of the 2500-series class, IP-based network traffic devices, a hardware-based Ethernet traffic generator, Ethernet packet capturing devices, and support equipment. The goal of the exercise is to develop additional information about the type and behavior of the vulnerability, assuming that many Cisco routers today remain un-patched. We provide additional information about the behavior of the Cisco vulnerability. Another goal is development of a test system, applying this problem scenario to it, and learning what issues need to be generally addressed when doing such testing. This is a valid security issue. Finally, a third goal was to do this at low cost, using legacy equipment as possible.