It's 2021 and you can hijack a Cisco SD-WAN deployment with malicious IP traffic and a buffer overflow. Patch now

Cisco this week emitted patches for four sets of critical-severity security holes in its products along with other fixes. The worst of the bugs can be exploited by sending specially crafted IP packets to a vulnerable installation, and overflowing a memory buffer to ultimately execute code as root on the machine, allowing the …

[jake]

A buffer overflow parsing packets?

The early 1980s is on line one, they're demanding their vulnerability back.

What's next? Default root passwords, shipped pre-installed for your convenience?

Seriously, does nobody at Cisco understand sanitizing inputs? And worse, is there no such thing as testing code before shipping anymore? That's sad.

[TimMaher]

1980s

That fits.

Have just bought a 2500 desk top switch. (I know, I know. Don’t go on.)

The web interface is so crap that you can’t even fix a static address on the management vlan.

Apparently they have known about this for years.

The work around is to use the cli except, their example doesn’t actually work.

So, this morning, I am having to go back ten years in my head, armed with the eighty odd page manual, and do the fix myself.

Utter crap!

[Brian Miller]

Re: A buffer overflow parsing packets?

"It's ____ and you can ___ a ___ with ___."

Lather, rinse, repeat.

The problem with input parsing is that #1, you need programmers who care about that, and #2, who will care about testing said code. Most of the time, like nearly all of it, #1 and #2 are nowhere to be found, so that old phrase is apt, again.

This isn't rocket science, but it is computer science that isn't being taught in schools. There are lots of good books about writing parsers, and software engineering for said software. The problem is getting management and programmers to pay attention, before it's headline news.

[sanmigueelbeer]

Re: A buffer overflow parsing packets?

is there no such thing as testing code before shipping anymore

Cisco has stopped testing codes internally for almost 10 years now. Getting rid of "testers" saved the company some cash.

Has anyone seen the prices for Cisco's SDA? It is not cheap.

[Mike 137]

"does nobody at Cisco understand sanitizing inputs?"

Does anyone, anywhere, understand sanitising inputs? Quite probably yes.

So why is this the most common entry point for network appliance and web compromises for over 30 years?

The majority of testing I've observed professionally is restricted to checking that expected inputs work. Checking for the unexpected is understandably harder as the field is typically much larger, but it's not impossible. Just takes resources and time, which are generally frowned on by the bean counters. There must be many developers that have to grit their teeth at products they feel to be unfinished being pushed out the door.

[Lee D]

Well, obviously.

It's software.

General rule is that if you don't want it to be possible, you have to isolate it using hardware. If you don't want arbitrary memory access for a process, for instance, there's no point in relying on the OS to do that for you. You have to have a hardware mechanism to enforce that.

Software-defined-anything is just software, vulnerable to all the same problems that all software has.

[Anonymous Coward]

Bugs, or features?

US company, Crypto AG, etc. I'm sure you can see where I'm going with this..

Just thought I'd give you some paranoia to get you through the weekend.

:)

[Claptrap314]

Let's see what the judges think...

9.8, 9.9, 9.8, 9.6

Those are some really solid scores there. This team might easily win the gold with those numbers...

[pc-fluesterer.info]

oh shit, another backdoor uncovered

who does believe this was not a backdoor?

[jake]

Re: oh shit, another backdoor uncovered

Ol' Bill O'Ockham says no.