From psirt@cisco.com Tue Sep 3 21:35:28 2002 From: Cisco Systems Product Security Incident Response Team To: bugtraq@securityfocus.com Date: Tue, 3 Sep 2002 08:00:00 -0700 (UTC) Subject: Cisco Security Advisory: Cisco VPN 3000 Concentrator Multiple Vulnerabilities -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco VPN 3000 Concentrator Multiple Vulnerabilities Revision 1.0 For Public Release 2002 September 03 at 1500 UTC ---------------------------------------------------------------------- Contents Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice Distribution Revision History Cisco Security Procedures ---------------------------------------------------------------------- Summary The Cisco VPN 3000 series concentrators are a family of purpose-built, remote access Virtual Private Network (VPN) platforms for data encryption and authentication. This advisory documents multiple vulnerabilities for the Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client. These vulnerabilities are documented as Cisco bug ID's CSCdt56514, CSCdu15622, CSCdu35577, CSCdu82823, CSCdv66718, CSCdv88230, CSCdw22408, CSCdw50657, CSCdx07754, CSCdx24622, CSCdx24632, CSCdx39981, CSCdx54675 and CSCdy38035. Upgrading to the latest version of code for the Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client, version 3.5.5 or 3.6.1, would protect against all of these documented vulnerabilities. This advisory will be posted at http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml. Affected Products The Cisco VPN 3000 series concentrators are affected by these vulnerabilities. This series includes models 3005, 3015, 3030, 3060, 3080 and the Cisco VPN 3002 Hardware Client. +-------------------------------------------------+ | DDTS - Description | Affected Releases | |-----------------------------+-------------------| | CSCdt56514 - PPTP, IPSEC | * 3.6(Rel) | | internal authentication | * 3.5(Rel) to | | login vulnerability | 3.5.4 | | | * earlier than | | | 3.1.2 | | | * earlier than | | | 3.0.3(B) | | | * 2.x.x | |-----------------------------+-------------------| | CSCdu15622 - HTML parser | * earlier than | | processing vulnerability | 3.0.3(B) | | | * 2.x.x | |-----------------------------+-------------------| | CSCdu35577 - Concentrator | * earlier than | | gives out too much | 3.5.4 | | information in application | * 3.1.x | | layer banners | * 3.0.x | | | * 2.x.x | |-----------------------------+-------------------| | CSCdu82823 - BSD sourced | * earlier than | | telnetd vulnerability | 3.0.4 | | | * 2.x.x | |-----------------------------+-------------------| | CSCdv66718 - Windows PPTP | * earlier than | | client vulnerability | 2.5.2(F) | |-----------------------------+-------------------| | CSCdv88230, CSCdw22408 - | * earlier than | | User passwords visible with | 3.5.1 | | HTML view source | * earlier than | | vulnerability | 3.1.4 | | | * 3.0.x | | | * 2.x.x | |-----------------------------+-------------------| | CSCdw50657 - Certificate | * earlier than | | passwords visible with HTML | 3.5.2 | | view source vulnerability | * 3.1.x | | | * 3.0.x | | | * 2.x.x | |-----------------------------+-------------------| | CSCdx07754 - XML public | * earlier than | | rule vulnerability | 3.5.3 | | | * 3.1.x | | | * 3.0.x | | | * 2.x.x | |-----------------------------+-------------------| | CSCdx24622 - HTML pages | * earlier than | | access vulnerability | 3.5.3 | | | * 3.1.x | | | * 3.0.x | | | * 2.x.x | |-----------------------------+-------------------| | CSCdx24632 - HTML login | * earlier than | | processing vulnerability | 3.5.3 | | | * 3.1.x | | | * 3.0.x | | | * 2.x.x | |-----------------------------+-------------------| | CSCdx39981 - VPN client | * 3.6(Rel) | | authentication | * earlier than | | vulnerability | 3.5.5 | | | * 3.1.x | | | * 3.0.x | | | * 2.x.x | |-----------------------------+-------------------| | CSCdx54675 - LAN-to-LAN | * earlier than | | IPSEC tunnel vulnerability | 3.5.4 | | | * 3.1.x | | | * 3.0.x | | | * 2.x.x | |-----------------------------+-------------------| | CSCdy38035 - ISAKMP packet | * 3.6(Rel) | | processing vulnerability | * earlier than | | | 3.5.5 | | | * 3.1.x | | | * 3.0.x | | | * 2.x.x | +-------------------------------------------------+ These vulnerabilities do not affect the VPN Client software nor the Cisco VPN 5000 series concentrators. No other Cisco product is known to be affected by these vulnerabilities. To determine if a Cisco VPN 3000 series concentrator is running affected software, check the software revision via the web interface or the console menu. Details +-------------------------------------------------+ | DDTS - | Details | | Description | | |------------------+------------------------------| | CSCdt56514 - | If a Cisco VPN 3000 series | | PPTP, IPSEC | concentrator is set up for | | internal | internal authentication with | | authentication | only group accounts | | login | configured and no user | | vulnerability | accounts configured, then a | | | VPN client logging in using | | | PPTP or IPSEC user | | | authentication succeeds by | | | using a group name/password | | | as login credentials. | | | For VPN client connections | | | using IPSEC user | | | authentication, the Cisco | | | VPN series concentrator will | | | not allow the VPN client to | | | use the same group | | | name/password as what is | | | configured in the VPN | | | client's connection | | | properties, but if another | | | group account exists on the | | | concentrator, then using its | | | group name/password the VPN | | | client can authenticate to | | | the VPN concentrator. | | | The Cisco VPN 3002 Hardware | | | Client does not support PPTP | | | or incoming connections and | | | therefore is not vulnerable | | | to this problem. | |------------------+------------------------------| | CSCdu15622 - | Very long URL requests to | | HTML parser | the HTML interface cause the | | processing | VPN 3000 series concentrator | | vulnerability | to stop responding. The CPU | | | on the Cisco VPN | | | concentrator jumps to 100%. | | | The IP stack of the VPN | | | concentrator stops | | | responding. | | | The VPN concentrator | | | recovers approximately five | | | minutes after the DoS attack | | | is stopped. | |------------------+------------------------------| | CSCdu35577 - | The Cisco VPN 3000 series | | Concentrator | concentrators give out too | | gives out too | much information in | | much information | application layer banners. | | in application | The SSH banner gives out | | layer banners | information about the device | | | apart from the SSH version | | | numbers. The FTP banner | | | gives information about the | | | device and the local time. | | | An incorrect HTTP page | | | request gives out | | | information about the | | | device, the name of the | | | person who compiled the | | | software and the time of | | | compilation. | |------------------+------------------------------| | CSCdu82823 - BSD | Cisco VPN 3000 series | | sourced telnetd | concentrators run telnetd | | vulnerability | daemon code derived from the | | | BSD source and are | | | vulnerable to a buffer | | | overflow in the telnet | | | option handling, which can | | | cause the telnet daemon to | | | crash and result in a VPN | | | concentrator reload. This | | | vulnerability is also | | | documented as CERT Advisory | | | CA-2001-21. | | | Telnet is not permitted on | | | the public interface of the | | | VPN concentrator in the | | | default configuration and is | | | never permitted on the | | | public interface of the VPN | | | 3002 Hardware Client. | |------------------+------------------------------| | CSCdv66718 - | Windows native PPTP clients | | Windows PPTP | connecting with the No | | client | Encryption option set can | | vulnerability | cause the Cisco VPN 3000 | | | series concentrator, with | | | encryption set, to reload. | |------------------+------------------------------| | CSCdv88230, | On password containing HTML | | CSCdw22408 - | pages for the Cisco VPN 3000 | | User passwords | series concentrator it is | | visible with | possible for restricted | | HTML view source | access administrative users | | vulnerability | to observe the password in | | | clear text upon viewing the | | | source of the web page | | | without having the | | | appropriate level of | | | administrative access. | |------------------+------------------------------| | CSCdw50657 - | On the Certificate | | Certificate | Management HTML pages for | | passwords | the Cisco VPN 3000 series | | visible with | concentrator it is possible | | HTML view source | for administrative users to | | vulnerability | observe the unencrypted | | | certificate password in | | | clear text upon viewing the | | | source of the web page. | |------------------+------------------------------| | CSCdx07754 - XML | When a Cisco VPN 3000 series | | public rule | concentrator has the XML | | vulnerability | filter configuration enabled | | | on its public interface, the | | | configuration adds the rule | | | "HTTPS on Public Inbound | | | (XML-Auto)(forward/in)" to | | | the public filter and sets | | | the value for the protocol | | | incorrectly to "ANY" and the | | | value for the destination | | | port to "443". The VPN | | | concentrator checks the | | | destination port field value | | | only when the protocol is | | | set to TCP or UDP. So | | | enabling this filter | | | configuration effectively | | | allows any protocol on any | | | port through the VPN | | | Concentrator. | |------------------+------------------------------| | CSCdx24622 - | Users can access a few Cisco | | HTML pages | VPN 3000 series concentrator | | access | HTML pages containing | | vulnerability | limited information without | | | proper authentication. | |------------------+------------------------------| | CSCdx24632 - | It is possible to cause the | | HTML login | Cisco VPN 3000 series | | processing | concentrator to reload by | | vulnerability | modifying an HTML file and | | | posting very large strings | | | as the username/password | | | while accessing the HTML | | | interface on the VPN | | | concentrator. | |------------------+------------------------------| | CSCdx39981 - VPN | When using a VPN client it | | client | is possible to cause the | | authentication | Cisco VPN 3000 series | | vulnerability | concentrator to reload by | | | responding with a very large | | | string for the username | | | prompt. | |------------------+------------------------------| | CSCdx54675 - | The Cisco VPN 3000 series | | LAN-to-LAN IPSEC | concentrator does not drop | | tunnel | an incoming LAN-to-LAN | | vulnerability | connection even when it | | | already has a security | | | association for the same | | | remote network with another | | | device. Instead it | | | disconnects the previously | | | established connection and | | | establishes a connection | | | with the new device. The VPN | | | concentrator also does not | | | verify if the data coming | | | across a LAN-to-LAN | | | connection is being sourced | | | from the correct network. | |------------------+------------------------------| | CSCdy38035 - | Malformed or very large | | ISAKMP packet | ISAKMP packets can cause | | processing | device reloads in four | | vulnerability | instances: | | | * Upon receipt of a | | | malformed ISAKMP packet | | | * Upon having debug turned | | | on during the receipt of | | | various malformed | | | packets | | | * Upon receiving a very | | | large number of payloads | | | in an ISAKMP packet | | | * Upon having debug turned | | | on while receiving large | | | ISAKMP packets. | +-------------------------------------------------+ These vulnerabilities are documented as Cisco bug ID's CSCdt56514, CSCdu15622, CSCdu35577, CSCdu82823, CSCdv66718, CSCdv88230, CSCdw22408, CSCdw50657, CSCdx07754, CSCdx24622, CSCdx24632, CSCdx39981, CSCdx54675 and CSCdy38035, which require a CCO account to view and can be viewed after 2002 September 4 at 1500 UTC. Impact +-------------------------------------------------+ | DDTS - Description | Impact | |------------------------+------------------------| | CSCdt56514 - PPTP, | Unintended access to | | IPSEC internal | the network serviced | | authentication login | by the VPN 3000 series | | vulnerability | concentrator. | |------------------------+------------------------| | CSCdu15622 - HTML | This vulnerability can | | parser processing | be exploited to | | vulnerability | initiate a DOS attack. | |------------------------+------------------------| | CSCdu35577 - | The extra information | | Concentrator gives out | given out could help | | too much information | an attacker plan his | | in application layer | attacks. | | banners | | |------------------------+------------------------| | CSCdu82823 - BSD | This vulnerability can | | sourced telnetd | be exploited to | | vulnerability | initiate a DOS attack. | |------------------------+------------------------| | CSCdv66718 - Windows | This vulnerability can | | PPTP client | be exploited to | | vulnerability | initiate a DOS attack. | |------------------------+------------------------| | CSCdv88230, CSCdw22408 | Unintended disclosure | | - User passwords | of passwords on non | | visible with HTML view | administrative user | | source vulnerability | accessed HTML pages. | |------------------------+------------------------| | CSCdw50657 - | Unintended disclosure | | Certificate passwords | of passwords on an | | visible with HTML view | administrative user | | source vulnerability | accessed HTML page. | |------------------------+------------------------| | CSCdx07754 - XML | Unintended access to | | public rule | the network serviced | | vulnerability | by the Cisco VPN 3000 | | | series concentrator. | |------------------------+------------------------| | CSCdx24622 - HTML | Unintended access to | | pages access | generic content on a | | vulnerability | few HTML pages. | |------------------------+------------------------| | CSCdx24632 - HTML | This vulnerability can | | login processing | be exploited to | | vulnerability | initiate a DOS attack. | |------------------------+------------------------| | CSCdx39981 - VPN | This vulnerability can | | client authentication | be exploited to | | vulnerability | initiate a DOS attack. | |------------------------+------------------------| | CSCdx54675 - | This vulnerability can | | LAN-to-LAN IPSEC | be exploited to | | tunnel vulnerability | initiate a DOS attack. | |------------------------+------------------------| | CSCdy38035 - ISAKMP | These vulnerabilities | | packet processing | can be exploited to | | vulnerability | initiate DOS attacks. | +-------------------------------------------------+ Software Versions and Fixes +-------------------------------------------------+ | DDTS - Description | Fixed Releases | |---------------------------+---------------------| | CSCdt56514 - PPTP, IPSEC | * 3.6.1 or later | | internal authentication | * 3.5.5 or later | | login vulnerability | * 3.1.2 or later | | | for 3.1.x | | | releases | | | * 3.0.3(B) or | | | later for 3.0.x | | | releases | |---------------------------+---------------------| | CSCdu15622 - HTML parser | * 3.6(Rel) or | | processing vulnerability | later | | | * 3.5(Rel) or | | | later | | | * 3.1(Rel) or | | | later | | | * 3.0.3(B) or | | | later | |---------------------------+---------------------| | CSCdu35577 - Concentrator | * 3.6(Rel) or | | gives out too much | later | | information in | * 3.5.4 or later | | application layer banners | | |---------------------------+---------------------| | CSCdu82823 - BSD sourced | * 3.6(Rel) or | | telnetd vulnerability | later | | | * 3.5(Rel) or | | | later | | | * 3.1(Rel) or | | | later | | | * 3.0.4 or later | |---------------------------+---------------------| | CSCdv66718 - Windows PPTP | * 3.6(Rel) or | | client vulnerability | later | | | * 3.5(Rel) or | | | later | | | * 3.1(Rel) or | | | later | | | * 3.0(Rel) or | | | later | | | * 2.5.2(F) or | | | later | |---------------------------+---------------------| | CSCdv88230, CSCdw22408 - | * 3.6(Rel) or | | User passwords visible | later | | with HTML view source | * 3.5.1 or later | | vulnerability | * 3.1.4 or later | |---------------------------+---------------------| | CSCdw50657 - Certificate | * 3.6(Rel) or | | passwords visible with | later | | HTML view source | * 3.5.2 or later | | vulnerability | | |---------------------------+---------------------| | CSCdx07754 - XML public | * 3.6(Rel) or | | rule vulnerability | later | | | * 3.5.3 or later | |---------------------------+---------------------| | CSCdx24622 - HTML pages | * 3.6(Rel) or | | access vulnerability | later | | | * 3.5.3 or later | |---------------------------+---------------------| | CSCdx24632 - HTML login | * 3.6(Rel) or | | processing vulnerability | later | | | * 3.5.3 or later | |---------------------------+---------------------| | CSCdx39981 - VPN client | * 3.6.1 or later | | authentication | * 3.5.5 or later | | vulnerability | | |---------------------------+---------------------| | CSCdx54675 - LAN-to-LAN | * 3.6(Rel) or | | IPSEC tunnel | later | | vulnerability | * 3.5.4 or later | |---------------------------+---------------------| | CSCdy38035 - ISAKMP | * 3.6.1 or later | | packet processing | * 3.5.5 or later | | vulnerability | | +-------------------------------------------------+ The procedure to upgrade to the fixed software version is detailed at http://www.cisco.com/univercd/cc/td/doc/product/vpn/vpn3000/vpn3kco/vcoug/usr_3_0/admin.htm#xtocid2259937. Obtaining Fixed Software Cisco is offering free software upgrades to address these vulnerabilities for all affected customers. Customers may only install and expect support for the feature sets they have purchased. Customers with service contracts should contact their regular update channels to obtain the free software upgrade identified via this advisory. For most customers with service contracts, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com/pcgi-bin/tablebuild.pl/vpn3000-3des. To access this link you must be a registered user and you must be logged in. Customers whose Cisco products are provided or maintained through a prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with obtaining the free software upgrade(s). Customers who purchased directly from Cisco but who do not hold a Cisco service contract, and customers who purchase through third party vendors but are unsuccessful at obtaining fixed software through their point of sale, should obtain fixed software by contacting the Cisco Technical Assistance Center (TAC) using the contact information listed below. In these cases, customers are entitled to obtain an upgrade to a later version of the same release or as indicated by the applicable corrected software version in the Software Versions and Fixes section (noted above). Cisco TAC contacts are as follows: * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Please have your product serial number available and give the URL of this advisory as evidence of your entitlement to a free upgrade. Please do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades. Workarounds +-------------------------------------------------+ | DDTS - Description | Workarounds / | | | Mitigation techniques | |------------------------+------------------------| | CSCdt56514 - PPTP, | If possible use | | IPSEC internal | external | | authentication login | authentication like | | vulnerability | TACACS+ or RADIUS. | |------------------------+------------------------| | CSCdu15622 - HTML | Restrict access to the | | parser processing | HTML interface such | | vulnerability | that connections are | | | permitted only from | | | trusted sources. | |------------------------+------------------------| | CSCdu35577 - | There is no | | Concentrator gives out | workaround. | | too much information | | | in application layer | | | banners | | |------------------------+------------------------| | CSCdu82823 - BSD | Restrict access to the | | sourced telnetd | telnet interface such | | vulnerability | that connections are | | | permitted only from | | | trusted sources. | |------------------------+------------------------| | CSCdv66718 - Windows | If possible configure | | PPTP client | the VPN 3000 series | | vulnerability | concentrator for IPSEC | | | support only. | |------------------------+------------------------| | CSCdv88230, CSCdw22408 | Restrict access to the | | - User passwords | HTML interface such | | visible with HTML view | that connections are | | source vulnerability | permitted only from | | | trusted sources. | |------------------------+------------------------| | CSCdw50657 - | Restrict access to the | | Certificate passwords | HTML interface such | | visible with HTML view | that connections are | | source vulnerability | permitted only from | | | trusted sources. | |------------------------+------------------------| | CSCdx07754 - XML | Remove any XML filter | | public rule | on the public | | vulnerability | interface. | |------------------------+------------------------| | CSCdx24622 - HTML | Restrict access to the | | pages access | HTML interface such | | vulnerability | that connections are | | | permitted only from | | | trusted sources. | |------------------------+------------------------| | CSCdx24632 - HTML | Restrict access to the | | login processing | HTML interface such | | vulnerability | that connections are | | | permitted only from | | | trusted sources. | |------------------------+------------------------| | CSCdx39981 - VPN | There is no | | client authentication | workaround. | | vulnerability | | |------------------------+------------------------| | CSCdx54675 - | There is no | | LAN-to-LAN IPSEC | workaround. | | tunnel vulnerability | | |------------------------+------------------------| | CSCdy38035 - ISAKMP | There is no | | packet processing | workaround. | | vulnerability | | +-------------------------------------------------+ The Cisco PSIRT recommends that affected users upgrade to a fixed software version of code. Exploitation and Public Announcements The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. These vulnerabilities were reported to PSIRT by internal development testing and customers. The invalid ISAKMP packet length vulnerability addressed by CSCdy38035 was reported to the PSIRT by Phenoelit. The vulnerabilities addressed by CSCdx24622 and CSCdx24632 were reported to Cisco by Vigilante. Status of This Notice: FINAL This is a final advisory. Although Cisco cannot guarantee the accuracy of all statements in this advisory, all of the facts have been checked to the best of our ability. Cisco does not anticipate issuing updated versions of this advisory unless there is some material change in the facts. Should there be a significant change in the facts, Cisco may update this advisory. A stand-alone copy or paraphrase of the text of this security advisory that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution This advisory will be posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml. In addition to worldwide website posting, a text version of this advisory is clear-signed with the Cisco PSIRT PGP key having the fingerprint FEB1 1B89 A64B 60BB 4770 D1CE 93D2 FF06 F236 759C and is posted to the following e-mail and Usenet news recipients: * cust-security-announce@cisco.com * bugtraq@securityfocus.com * full-disclosure@lists.netsys.com * first-teams@first.org (includes CERT/CC) * firewalls@lists.gnac.com * cisco-nsp@puck.nether.net * cisco@spot.colorado.edu * comp.dcom.sys.cisco * Various internal Cisco mailing lists Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History +-------------------------------------------------+ | Revision 1.0 | 2002-September-03 | Initial | | | | public | | | | release | +-------------------------------------------------+ Cisco Security Procedures Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/go/psirt. This includes instructions for press inquiries regarding Cisco security advisories. ---------------------------------------------------------------------- This advisory is copyright 2002 by Cisco Systems, Inc. This advisory may be redistributed freely after the release date given at the top of the text, provided that redistributed copies are complete and unmodified, including all date and version information. ---------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.8 Comment: Signed by Sharad Ahlawat, Cisco Systems PSIRT iQA/AwUBPXTpuZPS/wbyNnWcEQKH3QCgqX/zUSCmAGdEztRECYxMzA9DkzQAoPUZ zlE2/1p6Twm7HHuunr1vQ2p7 =C4g0 -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGP 6.5.8 mQGiBD0HcvwRBADMNGazqD/bDWjJVBKrPrW3vSRReXB5y2HGfmZXS0C4xB/3VJGR d+JeTnqam4q7hbBab9kery6cNL9cdZWI+LInX8DUT/s+vlUTrIdZmAphxKtDwZLw W9rXKLQMeVpNfb64SrIqlcjq/DGEYAqVt3ycPXJiPl8JroDaKFSG1vKbTQCg/xJG Ljl1bWvPx6O602cNaX5BrmUEALMSC++ppvP587TCHSdLzhfVBWw+zbt2a+gTkahz t+VhymnBNWxNIlbU/U1StEaFwfBVPliVKmTj5LQwPetbIf783q+5ak0W9FM8BYy8 9XVt8S/AYdYRw5/1YJA3OnprdIwaMDDtrQEy/dmpHYe0Vcay5tSM4M2MgOHJcVba hgktBACUHDDduj1qRzEybgLPSmwNS9jFpMC4PebBrw9c2O9idUufGt5A5we/ii5U G/0s4vpr1zGhKPbmzWaU5+jSH1XfPVg3EF8H5K7meC7LVPYwYjYi6z1ir07zhEfD wDRil5qve6rJNEZX5GLEysDhXYTw8hrwVv7bJSSlsJiMEqllEbRHQ2lzY28gU3lz dGVtcyBQcm9kdWN0IFNlY3VyaXR5IEluY2lkZW50IFJlc3BvbnNlIFRlYW0gPHBz aXJ0QGNpc2NvLmNvbT6JAF4EEBECAB4FAj0HcvwFCQW9+IAICwMJCAcCAQoCGQEF GwMAAAAACgkQk9L/BvI2dZwoYwCgrFpZ5dh8IPAt4C/hkz6o+H9b6IwAoL+kvWjx 0Ij9mhNoEH+woJJCKjh2iQBKBBARAgAKBQI9B4cLAwUBeAAKCRCKY8lJ671ScWeu AJ9QQeUds+YrB8knbCMdoOIizI44pwCfVsbFKOS2mnR6GuPGRHx6TYap/ieJAEYE EBECAAYFAj0H3ooACgkQGoGomMEqmWyzPACeMnMro1hvO4ka23G2Z6JhZldeRVEA oNom27aJ3+OxrhaUtBJt/SWVdVafiQBjBBARAgAjBQI9B4ieAwUBeBgGPFtePl0r W0AuXWNpc2NvXC5jb20+JAAACgkQcJKanG3DGCHNdwCeP+XUPnt12BVZYAf5J+6Q g5d9wTAAoM2XXNqrMm5Y/ScvExXoYXyk/q81iQCcBBABAQAGBQI9B4TXAAoJEMAF eq0PniW5vLwEALCv9TkPbxdn29NzZJkI9vAqnX4OV79LfvQsB1J+Sck3f1lsvamq r6kUsfqz2P4sB52KjZi8Cci3AHDP7Z5Iwl56raNiPEA00uUXh4vk1N7dTA4OfjDp 1LSciYHYOYxh6d3v47GphnBNckOdCH9iuaWJuRX86SHtshyJvHmR+wOtiQBGBBAR AgAGBQI9B4ZCAAoJEOJaQ7r9SlMepRMAoPIlX+Pem9o5r1UjjpxT7aQyiFP/AKCz yyQzbP5/IizPfxB2GTK92QSZVYkARgQQEQIABgUCPQeGcQAKCRCXb+VkX5DhIof5 AKC87+Znu5p+y69Z/szsL5fYv+RT2QCg6TMl/IeLDU9D+hwG6FqHBQbRyuWJAGME EBECACMFAj0Pq4IDBQF4GAY8W14+XStbQC5dY2lzY29cLmNvbT4kAAAKCRD4P8wi wv94DQX8AJ4mPJORrcEkCQxe7joRf1VJNzvITQCglE7/y1X9T0iI3tpO2zBo5uyb KU+JAEYEEBECAAYFAj0XzCQACgkQSQjoesB49NLGSwCdGAFWJOOBFFBBQWiUyQ3l 7a596OIAoM/iw5ARHocvByCSsHlkYAvORdbIiQEcBBABAgAGBQI9HQOaAAoJELe9 L3c4tW498B4H/iXMyJpr0u6hU1xaGpPklQjI9oB3TpH0ASxi/SmlGZ1Y/xNzxxrC RjPBnRwvPVUSPzJidlF9SGhsGGZVBAfUbMihwmnPr0kbM8SoZGNqF0Vzqraim/ds wiw4QUWSGw3csw8h18wtfxipNipnjP06qilHiIHipN4Q7nhuV3nQ+8o8Bz7sZvZS ei6JfkT21BcHCLtxfI0022jeTSoQG6GqQjs02rbIKBjOj98Qr6yt4lu4EY3LNMDW N9dX+usAf43e2asizF5k1ALIbktaEZQDgq2FYWwXFw1UTlB8lpl4uL5OZ78Bx18V NFBedZ4jqIvj8jGk8CbKA8fNOd9EIioXyqm0UENpc2NvIFN5c3RlbXMgUHJvZHVj dCBTZWN1cml0eSBJbmNpZGVudCBSZXNwb25zZSBUZWFtIDxzZWN1cml0eS1hbGVy dEBjaXNjby5jb20+iQBGBBARAgAGBQI9B3NPAAoJEJPS/wbyNnWc8bcAoL4jgdol jMJs8qkGV5s9L8EVHodgAJ41Pnr7cL0AV2cBvdiJjJX0UAOJnokASgQQEQIACgUC PQeHHwMFAXgACgkQimPJSeu9UnEShwCfUen+P64gmYXlf6aWMoBudz7/gEgAoKHP GMzGRTLPQ2VO27AXfM1qMqOPiQBGBBARAgAGBQI9B96TAAoJEBqBqJjBKplsY2IA oN/eovYSQsE34i2tfeSy/3X8vFWXAKDgnRmSe9SGdtLIDXZbPI9VshGnEIkAYwQQ EQIAIwUCPQeItwMFAXgYBjxbXj5dK1tALl1jaXNjb1wuY29tPiQAAAoJEHCSmpxt wxghLBgAn2cjBC9yOd14unFoJrXv0eKixEQaAKCsDBGsECGI+ru8keXJ2zJYSOF+ 74kAnAQQAQEABgUCPQeFBwAKCRDABXqtD54lua3JBAC+O2uyXzj8wMTThpgeoeBT 95u4Smug8G+tPVrrkqd2SK8zXlpscAGQugklXw7drmj2Ph8bwocnQxDWQH9kCApj eXCWGCBLZnsehghtkaofDq0wp7fugmDwhaRApsERHnRVlCNA/8vB5FMCBfJA6xkU riRTvxEmHn5uwcDYgzFJB4kARgQQEQIABgUCPQeGeQAKCRDiWkO6/UpTHtTYAKCA 8pd5aARjTMjCBfXUL5HqesgeawCgh8pF7agO1H7E6YAoDEAcQK5QNVKJAEYEEBEC AAYFAj0HhoQACgkQl2/lZF+Q4SJPKQCg62cLZCePXBq9fn/CUTJa0GeDepkAnjgh YGC24VB+E5/4T3wsy98+tsgriQBjBBARAgAjBQI9D6uhAwUBeBgGPFtePl0rW0Au XWNpc2NvXC5jb20+JAAACgkQ+D/MIsL/eA1YdACgp7PGp51wgiA9+nRqF8Be826b 4GYAoN0Xz7k6Vm2wtdANIMFc+11H5gdriQBGBBARAgAGBQI9F8wuAAoJEEkI6HrA ePTS7KcAoLcgqYzzNY1g1WK9q/D0cIzzHstFAKDcBTGI3DNtJ6wnqzecq5WPxnmk D7kCDQQ9B3L8EAgA9kJXtwh/CBdyorrWqULzBej5UxE5T7bxbrlLOCDaAadWoxTp j0BV89AHxstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJPPT2N286Z4VeSWc39 uK50T8X8dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrUGvC/RgBYK+X0iP1Y TknbzSC0neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8BD8KVbGI2Ou1WMuF040zT9 fBdXQ6MdGGzeMyEstSr/POGxKUAYEY18hKcKctaGxAMZyAcpesqVDNmWn6vQClCb AkbTCD1mpF1Bn5x8vYlLIhkmuquiXsNV6TILOwACAgf/dfUAIBxFgArE2xwYooN3 n6fkM/LIuVIzixkyNSgqH9KaOJ41cn8jncbdt31tyH++aK7mMuyQm7nkgy/B8U7w 9xYORl1mOsgUSGylPLxo2vengnqBO+Ua5hcngfvLuDUV8N9Ai0TWPfyTveyRQSPY ODOapdU8uCk3dFiZpgfTBh7hqlLRiNpTXHEK8dNsEy/q2HqLx/9hTQMXWqViK17q CfmwRLO94W1RIk6+CTwIa6tN9+ZicthCHRvUTRxDLfuuyY7qrDa4QM6HFAO+NyN9 Z9SeZSlbGoUN+AAEPZ9ej1T5Ca0WLCD9tF5a+ujN/GrSg2EidGUh/phZXYKYYsrh WYkAUgQYEQIAEgUCPQdy/AUJBb34gAUbDAAAAAAKCRCT0v8G8jZ1nP24AJ9nkeTV qE6/EOoOIuhxwtihvhea6wCgx6iK+imU7xZZDSGl9RudFTo08Ew= =UuaC -----END PGP PUBLIC KEY BLOCK-----