Description
Unspecified vulnerability in Cisco IOS 12.0 through 12.4 allows context-dependent attackers to cause a denial of service (device restart and BGP routing table rebuild) via certain regular expressions in a "show ip bgp regexp" command. NOTE: unauthenticated remote attacks are possible in environments with anonymous telnet and Looking Glass access.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Cisco IOS 12.3 - Show IP BGP Regexp Remote Denial of Service EDB-30506 · dos · Aug 17, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 26798 third-party-advisory
- 25352 vdb-entry
- 1018685 vdb-entry
- [cisco-nsp] 20070817 Heads up: "sh ip bgp regexp" crashing router mailing-list
- http://www.heise-security.co.uk/news/94526/
- [cisco-nsp] 20070817 About the posting entitled "Heads up: "sh ip bgp regexp" crashing router" mailing-list
- http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=WAN%2C%20Routing%20and%20Switching&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1ddf7bc9
- 20070912 Cisco IOS Reload on Regular Expression Processing vendor-advisory
- ADV-2007-3136 vdb-entry