cisco.00-05-14.http

2000-05-17T00:00:00
ID PACKETSTORM:10021
Type packetstorm
Reporter cisco.com
Modified 2000-05-17T00:00:00

Description

                                        
                                            `-----BEGIN PGP SIGNED MESSAGE-----  
  
Cisco IOS HTTP Server Vulnerability  
  
Revision 1.0  
  
For public release 2000 May 14 at 09:00 US/Eastern (UTC+0400)  
  
------------------------------------------------------------------------  
  
Summary  
  
A defect in multiple releases of Cisco IOS software will cause a Cisco  
router or switch to halt and reload if the IOS HTTP service is enabled and  
browsing to "http://<router-ip>/%%" is attempted. This defect can be  
exploited to produce a denial of service (DoS) attack. This defect has been  
discussed on public mailing lists and should be considered public  
information.  
  
The vulnerability, identified as Cisco bug ID CSCdr36952, affects virtually  
all mainstream Cisco routers and switches running Cisco IOS software  
releases 11.1 through 12.1, inclusive. The vulnerability has been corrected  
and Cisco is making fixed releases available to replace all affected IOS  
releases. Customers are urged to upgrade to releases that are not vulnerable  
to this defect as shown in detail below.  
  
The vulnerability can be mitigated by disabling the IOS HTTP server, using  
an access-list on an interface in the path to the router to prevent  
unauthorized network connections to the HTTP server, or applying an  
access-class option directly to the HTTP server itself. The IOS HTTP server  
is enabled by default only on Cisco 1003, 1004, and 1005 routers that are  
not configured. In all other cases, the IOS http server must be explicitly  
enabled in order to exploit this defect.  
  
The complete advisory is available at  
http://www.cisco.com/warp/public/707/ioshttpserver-pub.shtml .  
  
------------------------------------------------------------------------  
  
Affected Products  
  
The following list of products are affected if they are running a release of  
Cisco IOS software that has the defect. To determine if a Cisco product is  
running IOS, log in to the device and issue the command show version.  
Classic Cisco IOS software will identify itself simply as "Internetwork  
Operating System Software" or "IOS (tm)" software and will display a version  
number. Other Cisco devices either will not have the show version command,  
or will give different output. Compare the version number obtained from the  
router with the versions presented in the Software Versions and Fixes  
section below.  
  
Cisco devices that may be running affected releases include:  
  
* Cisco routers in the AGS/MGS/CGS/AGS+, IGS, RSM, 800, ubr900, 1000,  
2500, 2600, 3000, 3600, 3800, 4000, 4500, 4700, AS5200, AS5300, AS5800,  
6400, 7000, 7200, ubr7200, 7500, and 12000 series.  
* Most recent versions of the LS1010 ATM switch.  
* The Catalyst 6000 if it is running IOS.  
* Some versions of the Catalyst 2900XL LAN switch.  
* The Cisco DistributedDirector.  
  
For some products, the affected software releases are relatively new and may  
not be available on every device listed above.  
  
If you are not running classic Cisco IOS software then you are not affected  
by this vulnerability. Cisco products that do not run classic Cisco IOS  
software and thus are not affected by this defect include:  
  
* 700 series dialup routers (750, 760, and 770 series) are not affected.  
* Catalyst 1900, 2800, 2900, 3000, and 5000 series LAN switches are not  
affected except for some versions of the Catalyst 2900XL. However,  
optional router modules running Cisco IOS software in switch  
backplanes, such as the RSM module for the Catalyst 5000 and 5500, are  
affected (see the Affected Products section above).  
* The Catalyst 6000 is not affected if it is not running IOS.  
* WAN switching products in the IGX and BPX lines are not affected.  
* The MGX (formerly known as the AXIS shelf) is not affected.  
* No host-based software is affected.  
* The Cisco PIX Firewall is not affected.  
* The Cisco LocalDirector is not affected.  
* The Cisco Cache Engine is not affected.  
  
------------------------------------------------------------------------  
  
Details  
  
The HTTP server was introduced in IOS release 11.0 to extend router  
management to the worldwide web. The defect appears in a function added in  
IOS releases 11.1 and 11.2 that parses special characters in a URI of the  
format "%nn" where each "n" represents a hexadecimal digit. The  
vulnerability is exposed when an attempt is made to browse to  
"http://<router-ip>/%%". Due to the defect, the function incorrectly parses  
"%%" and it enters an infinite loop. A watchdog timer expires two minutes  
later and forces the router to crash and reload. Once it has resumed normal  
operation, the router is again vulnerable to the same defect until the HTTP  
server is disabled, access from untrusted hosts is prohibited, or the router  
is upgraded to a release of Cisco IOS software that is not vulnerable to  
this defect.  
  
In rare cases, the affected device fails to reload, forcing the  
administrator to cycle the power to resume operation. Some devices have  
reloaded without providing stack traces and may indicate wrongly that they  
were "restarted by power-on" when that did not occur.  
  
The HTTP server is not enabled by default except on unconfigured Cisco model  
1003, 1004, and 1005 routers. Once initial access is granted to configure  
the router, the customer may disable or limit access to the HTTP server by  
changing the configuration. Once the new configuration has been saved, the  
the HTTP server will not be enabled automatically when the router restarts.  
  
------------------------------------------------------------------------  
  
Impact  
  
Any affected Cisco IOS device that is operating with the HTTP server enabled  
and is not protected against unauthorized connections can be forced to halt  
for a period of up to two minutes and then reload. The vulnerability can be  
exercised repeatedly, possibly creating a denial of service (DoS) attack,  
until such time as the HTTP server is disabled, the router is protected  
against the attack, or the software on the router is upgraded to an  
unaffected release of IOS.  
  
In rare instances when a router at a remote location fails to reload, an  
administrator must visit the physical device to recover from the defect. In  
rare cases where no stack trace could be recovered and the router may  
erroneously report "restarted by power-on", the customer may be misled as to  
the true cause of a reload.  
  
------------------------------------------------------------------------  
  
Software Versions and Fixes  
  
The following table summarizes the major releases of Cisco IOS software  
affected by the defect described in this notice and scheduled dates on which  
the earliest corresponding fixed releases will be available. All dates are  
tentative and subject to change.  
  
Each row of the table shows the earliest release that contains the fix for  
the vulnerability in the "Rebuild", "Interim", or "Maintenance" columns,  
presented in release number order.  
  
A Maintenance Release is the most heavily-tested and highly-recommended  
release in a given row.  
  
A Rebuild Release is constructed from the previous maintenance or mainline  
release with the addition of a code fix for the specific defect. Although it  
receives less testing than a maintenance release, it is built from the  
previous maintenance release and includes only the minimum changes necessary  
to address the specific defect.  
  
An Interim Release has much less testing than a maintenance release and  
should be selected only if there is no other suitable release that fixes the  
defect.  
  
To find an appropriate replacement for a vulnerable release, compare the  
release number as reported by the show version command to the major releases  
in the first column below. For example, if your device reports that it is  
running 12.0(5)S, find the row in the table for 12.0S. Reading across to the  
right, you find that the earliest maintenance release containing the fix  
will be 12.0(11)S, which will be available for download from CCO on or about  
2000-5-29. The earliest interim release containing the fix will be  
12.0(10.6)S, available on or about 2000-05-15. The rebuild of the previous  
maintenance release, 12.0(10)S1, should be available on 2000-05-01.  
  
The only difference between 12.0(10)S and 12.0(10)S1 is the minimum change  
necessary to fix this vulnerability. In particular, 12.0(10)S1 will not  
contain any fixes or features applied to any interim releases since the  
earlier maintenance release, whereas the interim release, 12.0(10.6)S,  
contains the fix as well as the features and instabilities introduced by  
previous interim releases, 12.0(10.1)S through 12.0(10.5)S. Therefore, based  
on this example:  
  
* If you can apply a workaround or otherwise wait for the maintenance  
release, then upgrade to 12.0(11)S.  
  
Or  
  
* If you are running 12.0(10.1)S to 12.0(10.5)S inclusive and need some  
functionality introduced in those interim releases, upgrade to  
12.0(10.6)S. Upgrade to 12.0(11)S or later as soon as possible.  
  
Or  
  
* If you are running release 12.0(10)S or earlier, upgrade to 12.0(10)S1.  
  
In all cases, customers should exercise caution to be certain the devices to  
be upgraded contain sufficient memory and that their current hardware and  
software configurations will continue to be supported properly by the new  
release.  
  
---------+------------------+-------------------------------------------  
Major | Description or |   
Release | Platform | Availability of Repaired Releases*  
---------+------------------+-------------+--------------+--------------  
Unaffected Earlier Releases | Rebuild | Interim** | Maintenance  
---------+------------------+-------------+--------------+--------------  
11.0 & | | | |  
earlier, | | Not | Not |  
all | Numerous | vulnerable | vulnerable | Not vulnerable  
variants | | | |  
---------+------------------+-------------+--------------+--------------  
11.1-based Releases | Rebuild | Interim** | Maintenance  
---------+------------------+-------------+--------------+--------------  
| General | | |  
11.1 | Deployment (GD): | Unavailable | Unavailable | Unavailable  
| all platforms | | |  
---------+------------------+-------------+--------------+--------------  
| | | 11.1(33.2)CA | 11.1(34)CA  
11.1CA | Core/ISP support:| | |  
| rsp, c7200 | | |  
| | | 2000-05-08 | 2000-05-30  
---------+------------------+-------------+--------------+--------------  
| | 11.1(33)CC1 | 11.1(33.1)CC | 11.1(34)CC  
11.1CC | FIB support: rsp,| | |  
| c7200 | | |  
| | 2000-05-10 | 2000-05-22 | 2000-06-12  
---------+------------------+-------------+--------------+--------------  
11.2-based Releases | Rebuild | Interim** | Maintenance  
---------+------------------+-------------+--------------+--------------  
| General | 11.2(22a) | 11.2(22.2) | 11.2(23)  
11.2 | Deployment (GD): | | |  
| all platforms | 2000-05-29 | 2000-05-08 | 2000-07-10  
---------+------------------+-------------+--------------+--------------  
| IBM networking, | 11.2(22a)BC | 11.2(22.1)BC |  
11.2BC | CIP & TN3270 | | |  
| support: rsp | 2000-05-31 | 2000-05-05 |  
---------+------------------+-------------+--------------+--------------  
| | 11.2(22a)P | 11.2(22.2)P | 11.2(23)P  
11.2P | All platforms | | |  
| | 2000-05-29 | 2000-05-08 | 2000-07-17  
---------+------------------+-------------+--------------+--------------  
11.3-based Releases | Rebuild | Interim** | Maintenance  
---------+------------------+-------------+--------------+--------------  
| xDSL access | 11.3(1)DA9 | |  
11.3DA | multiplexer: | | |  
| c6200 | 2000-05-31 | |  
---------+------------------+-------------+--------------+--------------  
12.0-based Releases | Rebuild | Interim** | Maintenance  
---------+------------------+-------------+--------------+--------------  
| General | 12.0(11a) | 12.0(11.1) | 12.0(12)  
12.0 | Deployment (GD): | | |  
| all platforms | 2000-05-31 | 2000-05-22 | 2000-07-17  
---------+------------------+-------------+--------------+--------------  
| | 12.0(8)DA5 | |  
12.0DA | xDSL support: | | |  
| 6100, 6200 | | |  
| | 2000-05-31 | |  
---------+------------------+-------------+--------------+--------------  
| | 12.0(10)S1 | 12.0(10.6)S | 12.0(11)S  
12.0S | Core/ISP support:| | |  
| gsr, rsp, c7200 | | |  
| | 2000-05-03 | 2000-05-15 | 2000-05-29  
---------+------------------+-------------+--------------+--------------  
| | | 12.0(10.6)SC | 12.0(11)SC  
12.0SC | Cable/broadband | | |  
| ISP: ubr7200 | | |  
| | | 2000-05-15 | 2000-05-30  
---------+------------------+-------------+--------------+--------------  
| | 12.0(9)SL1 | | 12.0(10)SL  
12.0SL | 10000 ESR: c10k | | |  
| | 2000-05-15 | | 2000-05-31  
---------+------------------+-------------+--------------+--------------  
| | 12.0(9)ST1 | | 12.0(10)ST  
12.0ST | MPLS/VPN support:| | |  
| gsr, rsp, c7200 | | |  
| | 2000-05-31 | | 2000-06-12  
---------+------------------+-------------+--------------+--------------  
| cat8510c, | | | 12.0(5)W5(13d)  
| cat8540c, c6msm | | |  
| | | | 2000-05-19  
+------------------+-------------+--------------+--------------  
| ls1010, cat8510m,| | | 12.0(7)W5(15c)  
| cat8540m | | |  
| | | | 2000-05-08  
+------------------+-------------+--------------+--------------  
12.0W5 | | | | 12.0(7)W5(15d)  
| cat2948g, cat4232| | |  
| | | | 2000-05-12  
+------------------+-------------+--------------+--------------  
| c5atm, c5atm, | | | 12.0(9)W5(17a)  
| c3620, c3640, | | |  
| c4500, c5rsfc, | | |  
| c5rsm, c7200, rsp| | | 2000-05-22  
---------+------------------+-------------+--------------+--------------  
12.1-based Releases | Rebuild | Interim** | Maintenance  
---------+------------------+-------------+--------------+--------------  
| General | 12.1(1b) | 12.1(2.1) | 12.1(3)  
12.1 | Deployment (GD) | | |  
| candidate: all | | |  
| platforms | 2000-05-01 | 2000-05-15 | 2000-07-10  
---------+------------------+-------------+--------------+--------------  
| Access & Dial | | |  
| Early Deployment | 12.1(1)AA2 | | 12.1(2)AA  
12.1AA | (ED): c5200, | | |  
| c5300, c5800, | 2000-05-31 | | 2000-05-22  
| dsc-c5800 | | |  
---------+------------------+-------------+--------------+--------------  
| | | | 12.1(1)DA  
12.1DA | xDSL support: | | |  
| 6160, 6260 | | |  
| | | | 2000-05-11  
---------+------------------+-------------+--------------+--------------  
| | | | 12.1(1)DB  
12.1DB | xDSL support: | | |  
| c6400 | | |  
| | | | 2000-05-30  
---------+------------------+-------------+--------------+--------------  
| | | | 12.1(1)DC  
12.1DC | xDSL NRP support:| | |  
| c6400r | | |  
| | | | 2000-05-15  
---------+------------------+-------------+--------------+--------------  
| ELB Early | | |  
| Deployment (ED): | 12.1(1)E2 | | 12.1(2)E  
12.1E | cat6k, 8500, | | |  
| ls1010, 7500, | 2000-05-04 | | 2000-05-30  
| 7200, 7100 | | |  
---------+------------------+-------------+--------------+--------------  
| Cable/broadband | | | 12.1(2)EC  
12.1EC | Early Deployment | | |  
| (ED): ubr7200 | | | 2000-05-30  
---------+------------------+-------------+--------------+--------------  
| New technology | | 12.1(2.0.1)T2| 12.1(2)T  
12.1T | Early Deployment | | |  
| (ED): all | | |  
| platforms | | 2000-05-01 | 2000-05-22  
---------+------------------+-------------+--------------+--------------  
| | 12.1(1)XA3 | | 12.1(2)T***  
12.1XA*** | Obsolete | | |  
| | 2000-05-31 | | 2000-05-22  
---------+------------------+-------------+--------------+--------------  
| Early Deployment | | | 12.1(1)XD  
12.1XD | (ED): limited | | |  
| platforms | | | 2000-05-15  
---------+------------------+-------------+--------------+--------------  
| Early Deployment | | | 12.1(1)XE  
12.1XE | (ED): limited | | |  
| platforms | | | 2000-05-08  
---------+------------------+-------------+--------------+--------------  
Notes   
------------------------------------------------------------------------  
* All dates are estimated and subject to change.  
  
** Interim releases are subjected to less rigorous testing than regular  
maintenance releases, and may have serious bugs.  
  
*** 12.1XA is obsolete. Customers should upgrade to 12.1(2)T when it  
becomes available. This is not a misprint.  
------------------------------------------------------------------------  
  
------------------------------------------------------------------------  
  
Obtaining Fixed Software  
  
Cisco is offering free software upgrades to remedy this vulnerability for  
all affected customers. Customers with service contracts may upgrade to any  
software release. Customers without contracts may upgrade only within a  
single row of the table above, except that any available fixed software  
release will be provided to any customer who can use it and for whom the  
standard fixed software release is not yet available. Customers may install  
only the feature sets they have purchased.  
  
Note that not all fixed software may be available as of the release date of  
this notice.  
  
Customers with contracts should obtain upgraded software through their  
regular update channels. For most customers, this means that upgrades should  
be obtained via the Software Center on Cisco's Worldwide Web site at  
http://www.cisco.com/.  
  
Customers without contracts should get their upgrades by contacting the  
Cisco Technical Assistance Center (TAC) as follows:  
  
* +1 800 553 2447 (toll-free call within North America)  
* +1 408 526 7209 (toll call from elsewhere in the world)  
* E-mail: tac@cisco.com  
  
Additional contact information for the TAC is on-line at  
http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml, including  
instructions and e-mail addresses for use by non-English speakers.  
  
Give the URL of this notice as evidence of your entitlement to a free  
upgrade. Free upgrades for non-contract customers must be requested through  
the TAC. Please do not contact either "psirt@cisco.com" or  
"security-alert@cisco.com" for software upgrades. You will obtain faster  
results by contacting the TAC directly.  
  
------------------------------------------------------------------------  
  
Workarounds  
  
In lieu of an upgrade, the threat may be eliminated or reduced by any of the  
following measures:  
  
* Completely disable the HTTP server using the command no ip http server  
while in global configuration mode.  
  
Or  
  
* If the HTTP server must remain enabled while unrepaired, network access  
to it can be controlled by applying a standard access list to the HTTP  
service itself. For example, if the router's HTTP service should be  
reachable only from a browser running on a computer at IP address  
10.1.2.3, then use the following commands in global configuration mode  
to create a standard access list and apply it to the HTTP server:  
  
access-list 1 permit 10.1.2.3  
ip http access-class 1  
  
If access list 1 is already in use, then choose another number in the  
range 0-99. The implicit deny rule added to the end of every access  
list will prevent access from any other IP addresses.  
  
Or  
  
* Prevent network access to a vulnerable HTTP server by blocking traffic  
in the network path to the server's port with an extended access list.  
Such a list would be applied on an interface of the vulnerable router  
itself or on another Cisco router in the path of a potential attack,  
e.g., applied inbound on the outside interface of an edge router. The  
port number used in the extended access list statement must be the  
default port used by the HTTP server, port 80, or equal to whatever  
value it may have been set via the ip http port command. Please use  
this particular workaround with great care; it cannot be recommended  
confidently without knowledge of specific customer network  
configurations.  
  
Be sure to save the resulting configuration in memory so that protection of  
the server is not inadvertently removed after a reload.  
  
------------------------------------------------------------------------  
  
Exploitation and Public Announcements  
  
This vulnerability was announced on the BUGTRAQ mailing list on 2000-04-27  
with sufficient information that anyone could exercise the flaw. The Cisco  
PSIRT responded the same day and acknowledged the vulnerability in e-mail to  
the BUGTRAQ list with preliminary information regarding estimates of  
affected platforms and releases as well as a workaround to mitigate the  
threat. Following the response to BUGTRAQ, the Cisco PSIRT sent a  
preliminary warning with similar content to cust-security-announce@cisco.com  
and several internal Cisco mailing lists.  
  
This vulnerability has been discussed in detail on full-disclosure mailing  
lists and web sites, and requires no special equipment to be exploited.  
  
The Cisco PSIRT has received no reports of malicious exploitation of this  
vulnerability.  
  
------------------------------------------------------------------------  
  
Status of This Notice: INTERIM  
  
This is an interim notice. Cisco expects the contents of this report will  
change. The reader is warned that this notice may contain inaccurate or  
incomplete information. Although Cisco cannot guarantee the accuracy of all  
statements in this notice, all of the facts have been checked to the best of  
our ability. Cisco anticipates issuing monthly updates of this notice until  
it reaches final status.  
  
------------------------------------------------------------------------  
  
Distribution  
  
This notice will be posted at  
http://www.cisco.com/warp/public/707/ioshttpserver-pub.shtml. In addition to  
this HTML version on Cisco's Worldwide Web site, a text version of this  
notice will be clear-signed with the Cisco PSIRT PGP key and posted to the  
following e-mail addresses and Usenet newsgroups:  
  
* cust-security-announce@cisco.com  
* bugtraq@securityfocus.com  
* firewalls@lists.gnac.net  
* first-teams@first.org (which includes the CERT/CC)  
* cisco@spot.colorado.edu  
* cisco-nsp@puck.nether.net  
* comp.dcom.sys.cisco  
* Various internal Cisco mailing lists  
  
Future updates of this notice, if any, will be placed on Cisco's Worldwide  
Web server, and may or may not be actively announced on mailing lists or  
newsgroups. Users concerned about this problem are encouraged to check the  
URL given above for any updates.  
  
------------------------------------------------------------------------  
  
Revision History  
  
-----------+-----------+------------------------------------------------  
Revision 1.0| 2000-05-14| Initial public release.  
-----------+-----------+------------------------------------------------  
  
------------------------------------------------------------------------  
  
Cisco Product Security Incident Assistance Process  
  
The web page at  
http://www.cisco.com/warp/public/707/sec_incident_response.shtml describes  
how to report security vulnerabilities in Cisco products, obtain assistance  
with security incidents, and register to receive product security  
information from Cisco Systems, Inc., including instructions for press  
inquiries regarding Cisco Security Advisories and notices. This advisory is  
Cisco's official public statement regarding this vulnerability.  
  
------------------------------------------------------------------------  
  
This notice is copyright 2000 by Cisco Systems, Inc. This notice may be  
redistributed freely after the release date given at the top of the text,  
provided that redistributed copies are complete and unmodified, including  
all date and version information.  
  
------------------------------------------------------------------------  
  
-----BEGIN PGP SIGNATURE-----  
Version: PGP 6.5.2  
  
iQEVAwUBOR+pUWiN3BRdFxkbAQHZYwgAmjz3K8SalTY1UvzvERQMgjfi/QSUwF7A  
cGzFFyvL4ZRnT2SwHqowVqYukhutmg5dcfYibFK4yUROvj5Rg/qxv4xJruTjAoqR  
wZXiQjZh8wX0/Dxt8hnyA8ZNbMsy3S+OHI5inJYULv5wK/mXhgp1idE6AP9ayBCM  
EvwAVTNz60a74qMEsFIjoVMCTxkLjB8yNydrr8EkP3bWWS9k0eVMmOtJcMSTVrlk  
ZNgpst4jLg4uvt+oJF2IEXgytJt9IELJ/a4S2N3GsglcojgueCeKSopU8goFhtg0  
enLUjf6My35ytOHGKWG/D/UwVFTrzkXKhQv40K3fOS1zL1s2TiVGRg==  
=wUl3  
-----END PGP SIGNATURE-----  
-----BEGIN PGP PUBLIC KEY BLOCK-----  
Version: PGP 6.5.2  
  
mQENAzhQ8qUCYQEIALshjezuQIzQT3zZrKrQit2HTNarH8iba6HLdN2niIDGW9LN  
ShhH0kPdD57EeOAkO2ccNvgY4HvJESgykBS6z86HULeiSVMv89TfQsKOv34cczYm  
BeYtcfbgkm4MM/37UjFxUGAIoOxVX/bzya/tegiYPAaTsOcaonxqaOds/kLIR32S  
/+3vcV6tu9QiiLwdKAGSN+KkrREP3qTFzKxmus1DKFz5o03yDMtYGplRQ62iae21  
I8NbQtVXvARN5bdG5+4KaqI9hsT/tz8dh8OgapdaD6ht0qkY8J2DGIa1xnai4Vbe  
hoz7Vozf65LErlbRWBVAn6XBD3qtaI3cFF0XGRsABRG0R0Npc2NvIFN5c3RlbXMg  
UHJvZHVjdCBTZWN1cml0eSBJbmNpZGVudCBSZXNwb25zZSBUZWFtIDxwc2lydEBj  
aXNjby5jb20+iQEVAwUQOFDypWiN3BRdFxkbAQEVgAf/Qins/ms1PNhD4ucJyGCY  
V60wz6hQX5FXCKxewSxPOMOxkbQeiNxqENYldTwH6RZ2eVXYJX0PKZjhUmpQCwg7  
aYQUv8GeROxQYlJx/j2FKmQcjIWLHQZImb7FxTFt0rgcCJI+ChGu8U3IqOmyeBmE  
44qXxU/IGhJaXj8jIkSUxeKFQtI9JSxsfNiqX8itjeJlYTF8Y1MnTiuhikM3y7JM  
sQFzrKSzhzfPcc3RqDAtbwYtvmb+6/9IGkHks2hox5ltJZ5v2c4lbReEpmLweDSf  
enojuPPoPug8zRS/xa1uHzSZ3XKQwLWfjwZwGMzTTHOAiMWo6wlbhNnR4LlN/upv  
uIkARgQQEQIABgUCOFDzRAAKCRBwkpqcbcMYIVfZAJ4z5xm+IJuj+byK+gNsNY7X  
FK4THgCfS0n95c/Gxvu9tOvRFH+uwQh2dgGJAHUDBRA4UPNs3nAfbKMmz4kBAejY  
AvoD771l0JZWwf5XmoCWLL0ChzbdFJqTsnd2zG4jGr1J91dkES4YDir4itqyWVRA  
VFzalYCYouNPhOJZKLXUphQnAQ7x74cDznEw+MYT9eavbYcSeKkBZNEdjE3vf67x  
4fSJAJUDBRA4UP5XwAV6rQ+eJbkBAX2CA/9GPlvk9EWTS54M6uTJCtC/6Bcx7phz  
InAUYEX7gjlBmNF7MdIy1UdUsNL2rTdR26peB6VwzT6uXRG+RbhpGVvfHdEmJ2ec  
brKaUmFisrVWB7Ho9NOo72xTru7GeJxGHb0xRcsDMCIYfyOCMvbr6lxMMAcD9zx3  
nMx4VDJ7RfSStrRQQ2lzY28gU3lzdGVtcyBQcm9kdWN0IFNlY3VyaXR5IEluY2lk  
ZW50IFJlc3BvbnNlIFRlYW0gPHNlY3VyaXR5LWFsZXJ0QGNpc2NvLmNvbT6JARUD  
BRA4UPL6aI3cFF0XGRsBAdYKCACIhd2yDPXITE2pQzukNo+jxrMeSnqvl4DUoP6f  
Ai64KLGYAqo+ZWuyFd1JLT5CtsaWuLXEBvt/9SevI/qbN18c9eSBko3wNcO49C+T  
s0uttahHplxMgArqTK8y1u35C7QUz0T9xRLPaKvXYARw3/wFdaPQYehrVWBThbxk  
KxJuamT3OT5uB7NgtkHK1nHpxuATj39EnvZSUTWe45ZBVulduGMG7grYRCQJ1jrG  
2Ei0FO/adFKZU6DxSygwjWCM9Fdh/dncs00G7tXW8fpfIRmdsVZuYIQ7HPkoiUJF  
87Hw+mdkZHiTAhPMuNO9AamZsIF65QcD4vera/zOXwU+MUcaiQBGBBARAgAGBQI4  
UPNYAAoJEHCSmpxtwxghi9gAn12vk1AazXrc9GVCdXC5oFpi1TmlAJ9BsHkWwGUr  
mLSAE3OE70LjxHHhDokAdQMFEDhQ84DecB9soybPiQEB2NoC/jSF5glFC5jfYjAp  
VMiZHgGZDA49lcf/VZDz7ZeJAkOtZZHzlycVAlCukLl0sXfIhgygmWj6WQPPIF2z  
COEjVgR625CRbYhrqC0H9ieWYJ3fu7GILoEb200GbSgUZifvq4kAlQMFEDhQ/mvA  
BXqtD54luQEBWzAD/31F6aic5ZV/u6HY/ChORildURolK8LfNTwwsmwN32ZcJOUb  
gSsU5cafE5XGaWvgVrPVKwAH9DFcviElBK+n7fhw+SRS5x+Ar8tZMKEgP5I9yIZX  
DHwNZmFdpmk95xoK4TvCd3iyj23HcaoAGroRtuVrv5UtBG9P+FDMxScgO/cR  
=sJ3p  
-----END PGP PUBLIC KEY BLOCK-----  
`