CiscoInTheSkyWithDiamonds

More documents

Recommendations

Info

Offset Size Meaning 0x0 8 Bit Protocol Sub-Type (AIPC, INBAND, SPAN, FTP, HA_HB_1, HA_HB_2, ANY, BEACON) 0x1 1 Bit Direction (From DP == VEM VSM / From CP == VSM VEM) 0x1 7 Bit Format (STUN RAW or STUN Encrypted) 0x2 16 Bit Domain-ID (configurable is from 1-4096) 0x4 4 Bit isec-Version (always 1) 0x4 4 Bit isec Key Version (always 1) 0x5 1 Bit Encryption (0 = not encrypted, 1 = encrypted) 0x5 1 Bit HMAC (0 = not present, 1 = present) Why exactly can the sender decide whether the communication is protected? Yes, the receiver honors these fields!
The VEM drivers allow debugging to be enabled on the ESXi shell “vemlog” tool When debugging STUN messages, values from the packet are used as index into a array of strings for debug output Of course, values may exceed array size This being an out-of-bounds read, it’s not exploitable, AFAWK But it highlights a general design problem
Page 1: Observed by Greg & FX
Page 4 and 5: 1967: First systems with IBM CP-67
Page 6 and 7: 10 GigE Virtual Switch
Page 9 and 10: Cisco Nexus Operating System (NX-OS
Page 11 and 12: This being a VMware VM, we can boot
Page 13 and 14: The N1kV requires license files to
Page 15 and 16: Let‘s see what that function does
Page 17 and 18: Exploitation is a bit tricky though
Page 19 and 20: The jailbreak script adds a user to
Page 21 and 22: Why talk about licensing? CSCud0142
Page 23 and 24: 6 bytes (12 hex chars) “signature
Page 25 and 26: We could now exercise our 1337 reve
Page 28 and 29: CDP is everywhere in Cisco land VM
Page 30 and 31: The VSM stores a set of “opaque d
Page 35 and 36: VEMs register themselves with the V
Page 37 and 38: Cisco’s documentation says 128 Bi
Page 39: 1. Compromise a web server in a vir
Page 42 and 43: At Phenoelit, FtR is the go-to-guy
Page 45: Our work with Cisco PSIRT goes back

CiscoInTheSkyWithDiamonds

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?