SecureState Releases Module for Metasploit Framework

CDP Tool Useful in Situations Where Users Imitate Cisco Device

(Cleveland, Ohio) SecureState, a leader in information security assessments and protection services, announces the release of an additional module for the Metasploit Framework, this time for forging Cisco Discovery Protocol frames. The Cisco Discovery Protocol has had a history of vulnerabilities in various IOS products. It is used in Cisco environments for devices to advertise information to other Cisco devices, such as versions and capabilities. Exploiting this protocol has usually resulted in Denial of Service conditions and required using various programs from less than reputable sources. One notable exception to this is Yersinia. However, the Metasploit Framework has been distributed with the Racket library, that provides an interface for forging raw CDP frames, provided by Jon Hart. SecureState is releasing a module that allows users to take advantage of this functionality.

The module allows users to set the various parameters of a CDP frame and then transmit it as often as they'd like to transmit. This is useful in situations where a user needs to imitate a Cisco device, such as a VoIP phone. Within the past year, another CDP bug was discovered in the Nexus line of switches from Cisco by George Hedfors. This bug, which was given the ID CSCtf08873, is triggered when a CDP message is received by the device with a "Device ID" greater than 255 bytes. Hedfors submitted the bug in the summer of 2010, and recently discussed it in his Black Hat EU presentation, "Owning the Data Centre."

More information on the Metasploit Framework can be found at www.metasploit.com

The source code for Yersinia can be found at www.yersinia.net

About SecureState

SecureState provides information security assessments and information protection to help our clients obtain and maintain their desired state of security. SecureState information protection consultants work to provide the very best physical, logical and personnel security services through audit and compliance, attack and penetration tests, data forensics, and security program building. Our clients span a variety of industries giving SecureState the experience of working in unique environments. We take that experience, combined with our consultants' experience of working for Military Intelligence, Big X Consulting, government agencies and various other law enforcement entities, and apply it to your organization.