Navigation

• Main Page

• Random Page
• Create a new Page
• All Pages
• Categories

• Administration
• File Management

• Login/Logout
• Language Selection
• Your Profile
• Create Account

Quick Search

Advanced Search »

Edit

Future detections

Edit

Data Structure Validation

Edit

vty_info

The vty_info data structure should be fund, parsed and validated to detect shellcode actions similar to the Andy Davis FTP exploit shellcode. Of special interest are the fields that determine if authentication is required at all and what privilege level a line has.

Edit

Stack Dumps and Backtraces

Edit

Automatic BackTrace analysis

CIR should inspect each process's stack and try to build a stack trace based on the very particular way the IOS code sets up stack frames. If the backtrace fails and/or shows inconsistencies, an alert should be produced.