Before getting too hyped about it though, someone with a Cisco firewall should dig further into it to understand the pre-requirements.
-
I was going to say, it sounds like a Heartbleed style buffer overread or other arbitrary read vuln.
Looks like it sends IKE packets with a very large Group-Prime option. If the Cisco is replying using the request length (1/2)
-
-
... but only filling in the requested 768 bit prime, then you've got yourself a buffer of uninitialized crap following it (2/2)
-
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.