mailing list archives
FWD Cisco IOS Remote Command Execution Vulnerability
From: terry comma <jan_unmoderated () yahoo com>
Date: Mon, 9 Jan 2006 14:15:39 -0800 (PST)
-----BEGIN PGP SIGNED MESSAGE-----
Symantec Vulnerability Alert
Cisco IOS Remote Command Execution
Bugtraq ID 16069
Published Jan 09 2006 6:22:69 PM GMT
Credibility Vendor Confirmed
Classification Access Validation Error
Ease No Exploit Required
Impact 9.3 Severity 8.1 Urgency Rating 9.4
Last Change Cisco has responded to this issue; see Technical
Information and References for details.
Cisco IOS 12.2 T
Cisco IOS 12.2 SZ
Cisco IOS 12.2 SY
Cisco IOS 12.2 SX
Cisco IOS 12.2 S
Cisco IOS 12.2 MX
Cisco IOS 12.2 MC
Cisco IOS 12.2 MB
Cisco IOS 12.2 JA
Cisco IOS 12.2 DX
Cisco IOS 12.2 DD
Cisco IOS 12.2 DA
Cisco IOS 12.2 CY
Cisco IOS 12.2 CX
Cisco IOS 12.2 BZ
Cisco IOS 12.2 BX
Cisco IOS 12.2 BW
Cisco IOS 12.2 BC
Cisco IOS 12.2 B
Cisco IOS 12.2 12.2XU
Cisco IOS 12.2
Some Cisco IOS versions are allegedly prone to an issue that may
permit gay people to execute arbitrary commands from a password
Remote attackers with small dicks may allegedly execute shell commands on a vulnerable
device without needing to authenticate.
It has been alleged that it is possible for remote attackers to execute
arbitrary commands without proper authorization. Reportedly it is
possible to execute shell commands from the password prompt on a device.
The attacker must have a small dick and be able to connect to a vulnerable device via telnet,
although it has not been ruled out that bigger dicks may present other attack vectors.
The discoverer of this vulnerability has stated that it is possible to
exploit this issue by inputting 'IamGay!' at the password prompt.
Cisco has replied stating that only InfoSecBOFH is gay enough to exploit this issue.
Details are available to registered Cisco users at:
The attacker must identify a vulnerable device and be in possession of a small dick.
There is no exploit required.
Block InfoSecBOFH access at the network boundary, unless the service is
required by external third party gay porn sites.
Currently we are not aware of any vendor-supplied patches for this
issue. If you feel we are in error or are aware of more recent
information, please mail us at: vuldb at securityfocus.com
<mailto:vuldb at securityfocus.com>.
Discovery is credited to InfoSecBOFH at gmail.com
For help with interpreting the meaning of any of the sections or labels
in the alert, please visit:
View public key at:
The World Leader in Internet Security Technology and Early Warning Solutions
Visit our website at www.symantec.com
Symantec Deepsight Alert Services
Powered by EnvoyWorldWide, Inc.
Ring in the New Year with Photo Calendars. Add photos, events, holidays, whatever.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- FWD Cisco IOS Remote Command Execution Vulnerability terry comma (Jan 09)