{"id":535,"date":"2008-11-14T19:52:50","date_gmt":"2008-11-14T17:52:50","guid":{"rendered":"http:\/\/security-planet.de\/?p=535"},"modified":"2008-11-14T19:52:50","modified_gmt":"2008-11-14T17:52:50","slug":"der-http-client-im-cisco-ios","status":"publish","type":"post","link":"https:\/\/cyber-fi.net\/index.php\/2008\/11\/14\/der-http-client-im-cisco-ios\/","title":{"rendered":"Der HTTP-Client im Cisco IOS"},"content":{"rendered":"<p>Vor einiger Zeit bin ich \u00fcber eine Schw\u00e4che in der HTTP-Client-Implementierung des Cisco IOS gestolpert. Aus der <a href=\"http:\/\/www.cisco.com\/en\/US\/docs\/ios\/netmgmt\/configuration\/guide\/nm_http_web.html\">Cisco-Doku<\/a>:<\/p>\n<blockquote><p>The Cisco implementation of the HTTP version 1.1 supports a subset of elements defined in RFC 2616. The following is a list of supported RFC 2616 headers:<\/p>\n<ul>\n<li>Allow (Only GET, HEAD, and POST methods are supported)<\/li>\n<li> Authorization, WWW-Authenticate &#8211; Basic authentication only<\/li>\n<li> Cache-control<\/li>\n<li> Chunked Transfer Encoding<\/li>\n<li> Connection close<\/li>\n<li> Content-Encoding<\/li>\n<li> Content-Language<\/li>\n<li> Content-Length<\/li>\n<li> Content-Type<\/li>\n<li> Date, Expires<\/li>\n<li>Location<\/li>\n<\/ul>\n<\/blockquote>\n<p>Und was fehlt da in der Liste? Der Host-Header. Das f\u00fchrt dazu, da\u00df das IOS bei einem Befehl wie<\/p>\n<pre><code>copy http:\/\/www.example.com\/file.txt flash:<\/code><\/pre>\n<p>anstelle des <strong><em>www.example.com<\/em><\/strong> im Host-Header die IP des Servers eintr\u00e4gt. Das geht bei den meisten gehosteten Umgebungen nat\u00fcrlich schief.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Vor einiger Zeit bin ich \u00fcber eine Schw\u00e4che in der HTTP-Client-Implementierung des Cisco IOS gestolpert. Aus der Cisco-Doku: The Cisco implementation of the HTTP version 1.1 supports a subset of elements defined in RFC 2616. The following is a list of supported RFC 2616 headers: Allow (Only GET, HEAD, and POST methods are supported) Authorization, <\/p>\n<div class=\"read-more-text\"><a href=\"https:\/\/cyber-fi.net\/index.php\/2008\/11\/14\/der-http-client-im-cisco-ios\/\" class=\"read-more\">continue reading<\/a><\/div>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"twitterCardType":"","cardImageID":0,"cardImage":"","cardTitle":"","cardDesc":"","cardImageAlt":"","cardPlayer":"","cardPlayerWidth":0,"cardPlayerHeight":0,"cardPlayerStream":"","cardPlayerCodec":"","footnotes":""},"categories":[5],"tags":[288,307,502],"class_list":["post-535","post","type-post","status-publish","format-standard","hentry","category-cisco","tag-http","tag-ios","tag-rfc-2616"],"_links":{"self":[{"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/posts\/535","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/comments?post=535"}],"version-history":[{"count":0,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/posts\/535\/revisions"}],"wp:attachment":[{"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/media?parent=535"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/categories?post=535"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber-fi.net\/index.php\/wp-json\/wp\/v2\/tags?post=535"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}