Onderwerp: [ADVISORY] CISCO ASA Failover DoS Vulnerability

-------------------=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=
=3D=3D=3D=3D=3D=3D=3D-------------------

Advisory : EPSIRT 051028-ASA01

Title : CISCO ASA Failover DoS Vulnerability

Release : November 14, 2005

Author : Amin Tora

Severity : Denial of Service

Risk Level: Low

Product : CISCO Adaptive Security Appliances
running: 7.0(0), 7.0(2), 7.0(4)

-------------------=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=
=3D=3D=3D=3D=3D=3D=3D-------------------

--=3D=3D Overview =3D=3D-

A possible denial of service against failover can occur due to a race=20
condition when there is an IP conflict or spoofed ARP response upon=20
active firewall failure.

--=3D=3D Details =3D=3D-

An inherent weakness in the CISCO ASA failover testing algorithm and=20
methodology was identified and noted to CISCO TAC and PSIRT. In=20
general, the two weaknesses have been identified as a race condition=20
between two different failover testing processes and a lack of=20
authentication for failover messages between active and standby. The=20
prior condition has been resolved and will be available in an upcoming=20
version of ASA software. These conditions are noted in CISCO bug IDs:

* CSCsc34022 - ASA-PIX requires improved failover testing method
* CSCsc47618 - Authenticate all messages between Active and Standby=20

In an Active/Standby configuration:=20

When failover LAN communications goes down {i.e. cable problem,=20
switch/hub failure, interface failure, ASA software bug, etc}, the=20
standby firewall sends ARP requests on each of the segments for the IP=20
address of the Active firewall to see if the Active is still alive. If=20
there is a response for AT LEAST ONE of the requests, the standby will=20
NOT become active (i.e. there is no failover).

This scenario can occur when:

1. Failover LAN interface fails AND you have a failure on any of the=20
other traffic carrying interfaces, EXCEPT for one.

2. Failover LAN interface fails AND you have a power failure on the=20
ACTIVE firewall, AND there exists an "IP address conflict" with a=20
traffic carrying interface.

Here, the "IP address conflict" can be another improperly configured=20
device with the same IP as assigned on a traffic carrying interface, or,

it could be an ARP spoof attack. =20

During such an outage, by sending at least one ARP response to the=20
standby's ARP requests an attacker can cause a "failover denial of=20
service" by not allowing the standby to become active - rendering the=20
failover solution ineffective.

The "interface-policy 1" command may or may not resolve this issue as=20
there is a race condition between to separate processes performing two=20
separate tests {i.e. one for interface failure and one for the ARP=20
test}. Depends on who gets to the finish line first.


--=3D=3D Impact =3D=3D-

It is believed the severity on this issue is low. An attacker would=20
require direct access to the network segment AND there would have to be=20
some form of failure on the active firewall.

All these conditions must be met for an attacker to succeed with the=20
denial of service:

1. Have some form of access to a local segment of the firewalls:
=20
A. Direct physical access to network segment to connect=20
their own system (i.e insider) OR
=20
B. Somehow inject continuous ARP reply packets onto the=20
segment via tunneling, etc. OR
=20
C. Have access to a compromised host on that segment

2. Have a failure on the primary.

3. Respond with spoofed ARP replies to the standby's ARP request
test.

The likelihood that all these conditions can be met is minimal but not=20
impossible as other attack methods may prove effective.


--=3D=3D Mitigation =3D=3D-

1. Prevent or correct IP address conflicts on the traffic carrying=20
segments.

2. The firewall will detect and log IP address conflicts with system=20
log message:

%PIX-4-405001: Received ARP response collision from <firewall IP=20
address/mac address of device with duplicate IP address> on interface=20
<firewall interface>.

3. Restrict via port security and/or filter ARP communications with=20
ACL's based on IP type 0x0806 and 0x0835.


--=3D=3D References =3D=3D-

Additional information about IP conflict log message:
http://www.cisco.com/univercd/cc/td/...sa_sw/v_70/sys
log/logmsgs.htm#wp1282234=20

Configuring failover on PIX and ASA:
http://www.cisco.com/univercd/cc/td/...sa_sw/v_70/con
fig/failover.htm=20

Catalyst 6500 Series Cisco IOS Software Configuration Guide Configuring=20
Port Security=20
http://www.cisco.com/en/US/products/...ucts_configura
tion_guide_chapter09186a0080160a2c.html=20

Catalyst 6500 Series Software Configuration Guide=20
Configuring Port Security=20
http://www.cisco.com/en/US/products/...ucts_configura
tion_guide_chapter09186a008022f27b.html=20

LAN Security Configuration Guides=20
http://www.cisco.com/en/US/tech/tk38...tion_guides_li
st.html=20

Blocking ARP packets with ACL's on 2970, 3550, 3560, and 3750:
http://www.cisco.com/en/US/products/...ucts_configura
tion_example09186a0080470c39.shtml

HPing packet generator
http://www.hping.org/

ARP Spoofing using DSniff:
http://naughty.monkey.org/~dugsong/dsniff/faq.html


--=3D=3D Credit =3D=3D-

Amin Tora, ePlus Security Team


--=3D=3D Contributors =3D=3D-

ePlus Security Team:

William Zegeer
Christopher Cole

Outside Contributors:

John Biasi
John Guerriero
Frank Vitale
Everyone at CISCO PSIRT

-------------------=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=
=3D=3D=3D=3D=3D=3D=3D-------------------
EOM

This is a multi-part message in MIME format.

------_=_NextPart_001_01C5E965.956A6BDA
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Response
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

This is Cisco PSIRT's response to the statements made by Amin Tora in
his
message: [ADVISORY] CISCO ASA Failover DoS Vulnerability, posted on=20
November 14, 2005.

The original email is available at
http://www.securityfocus.com/archive.../30/0/threaded

Attached is a cleartext, PGP signed version of this same email.

This issue is being tracked by two Cisco Bug IDs:

* CSCsc34022 -- ASA-PIX requires improved failover testing method

This DDTS has been resolved and the fix will be available in an upcoming
version of software. The standby firewall now validates both the IP
address and
MAC address of all active firewall interfaces while conducting failover
ARP
testing.

* CSCsc47618 -- Authenticate all messages between Active and Standby
Firewalls

This DDTS is under investigation and while not resolved there is a
workaround to=20
mitigate the issue.


We would like to thank Amin Tora for reporting this issue to us.

We greatly appreciate the opportunity to work with researchers on
security
vulnerabilities, and welcome the opportunity to review and assist in
product
reports.


Additional Information
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D

The Release Note Enclosure for CSCsc34022 states:
+------------------------------------------------

Symptom:
+-------

The Standby firewall in failover pair may not take over when the Active
firewall loses power or crashes.


Conditions:
+----------

For this issue to occur, a duplicate IP address matching one of the
active
firewall's IP addresses must be present on the same network subnet as
the
firewalls when the active firewall loses power or crashes.

When the active firewall loses power or crashes, the standby firewall's
LAN
failover interface will lose connectivity with the active firewall. This
causes
the standby firewall to ARP for the IP address of each active firewall
interface. Because the active firewall is now unreachable, the duplicate
IP
address matching the active firewall will cause the standby firewall to
receive
a reply to the ARP attempt. Upon receiving the erroneous ARP reply, the
standby firewall will believe that the active firewall is still
reachable and
prevent the standby firewall from taking over.

Due to the timing of two concurrent failover tests, there are still
cases where
the standby firewall will be able to determine that the active firewall
is down
even when a duplicate IP address is present; however, this can not be
guaranteed.


Workaround:
+----------

Connecting the LAN failover interfaces of the firewalls to switch ports
may
minimize but not completely mitigate the chance that an otherwise active
firewall will lose connectivity to its LAN failover interface.

Preventing or correcting IP addresses that duplicate the firewall IP
addresses
is a complete workaround for this issue.

The firewall will detect and log duplicate IP addresses with system log
message:

%PIX-4-405001: Received ARP response collision from <firewall IP
address/mac
address of device with duplicate IP address> on interface <firewall
interface>.

Additional information about this syslog message is available at:
http://www.cisco.com/univercd/cc/td/...sa_sw/v_70/sys
log/logmsgs.htm#wp1282234

Additional information about configuring failover in PIX and ASA 7.0 is
available at:
http://www.cisco.com/univercd/cc/td/...sa_sw/v_70/con
fig/failover.htm

Additional information about configuring failover in FWSM 2.3 is
available at:
http://www.cisco.com/univercd/cc/td/...0/mod_icn/fwsm
/fwsm_2_3/fwsm_cfg/failover.htm


The Release Note Enclosure for CSCsc47618 states:
+------------------------------------------------

Symptom:
+-------

An attacker who can spoof the IP address and MAC address of an active
firewall's interface may prevent failover from occurring.

Conditions:
+----------

When the active firewall loses power or crashes, the standby firewall's
LAN
failover interface will lose connectivity with the active firewall. This
causes
the standby firewall to ARP for the IP address of each active firewall
interface. The standby firewall will only accept the ARP response if the
source
MAC address matches the active firewall's interface MAC address. An
attacker
who can spoof the IP address and MAC address of the active firewall's
interface
can lead the standby firewall to believe that the active firewall is
still
reachable and prevent the standby firewall from taking over.

Workaround:
+----------

Configure port security on all switch ports configured to be in the same
vlans
as the active and standby firewalls enabled interfaces. Port security
must not
be enabled on the switch ports connected to the active and standby
firewalls
interfaces.

Port security will prevent an attacker from spoofing the active
firewall's
interface MAC address allowing failover to occur normally.

This configuration should be tested before being enabled in a production
environment.

For information on configuring port security refer to:
=20
Catalyst 6500 Series Cisco IOS Software Configuration Guide
Configuring Port Security
http://www.cisco.com/en/US/products/...ucts_configura
tion_guide_chapter09186a0080160a2c.html


Catalyst 6500 Series Software Configuration Guide
Configuring Port Security
http://www.cisco.com/en/US/products/...ucts_configura
tion_guide_chapter09186a008022f27b.html

LAN Security
Configuration Guides
http://www.cisco.com/en/US/tech/tk38...tion_guides_li
st.html

For information about layer 2 attacks and mitigations refer to:

SAFE Layer 2 Security In-depth Version 2
http://www.cisco.com/en/US/netsol/ns...networking_sol
utions_white_paper09186a008014870f.shtml


Cisco Security Procedures
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=


Complete information on reporting security vulnerabilities in Cisco
products,
obtaining assistance with security incidents, and registering to receive
security information from Cisco, is available on Cisco's worldwide
website at=20
http://www.cisco.com/en/US/products/...erability_poli
cy.html

This includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at=20
http://www.cisco.com/go/psirt



Regards,=20
Randy=20

Randy Ivener
Product Security Incident Response Team (PSIRT)
Cisco Systems, Inc.
rivener@cisco.com=20
http://www.cisco.com/go/psirt


-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBQ3kGnG4/EyDEWh8IEQKBhACbB6PVS/9UY3puPDYx5TZLxgkUp9IAoJem
ExnCz+YJioSK6OOENgSorGa5
=3DOr3I
-----END PGP SIGNATURE-----

------_=_NextPart_001_01C5E965.956A6BDA
Content-Type: application/octet-stream;
name="cisco-bugtraq-pix-failover.txt.asc"
Content-Transfer-Encoding: base64
Content-Description: cisco-bugtraq-pix-failover.txt.asc
Content-Disposition: attachment;
filename="cisco-bugtraq-pix-failover.txt.asc"

LS0tLS1CRUdJTiBQR1AgU0lHTkVEIE1FU1NBR0UtLS0tLQ0KSG FzaDogU0hBMQ0KDQpDaXNjbyBS
ZXNwb25zZQ0KPT09PT09PT09PT09PT0NCg0KVGhpcyBpcyBDaX NjbyBQU0lSVCdzIHJlc3BvbnNl
IHRvIHRoZSBzdGF0ZW1lbnRzIG1hZGUgYnkgQW1pbiBUb3JhIG luIGhpcw0KbWVzc2FnZTogW0FE
VklTT1JZXSBDSVNDTyBBU0EgRmFpbG92ZXIgRG9TIFZ1bG5lcm FiaWxpdHksIHBvc3RlZCBvbiAN
Ck5vdmVtYmVyIDE0LCAyMDA1Lg0KDQpUaGUgb3JpZ2luYWwgZW 1haWwgaXMgYXZhaWxhYmxlIGF0
DQpodHRwOi8vd3d3LnNlY3VyaXR5Zm9jdXMuY29tL2FyY2hpdm UvMS80MTY1NDQvMzAvMC90aHJl
YWRlZA0KDQoNClRoaXMgaXNzdWUgaXMgYmVpbmcgdHJhY2tlZC BieSB0d28gQ2lzY28gQnVnIElE
czoNCg0KICogQ1NDc2MzNDAyMiAtLSBBU0EtUElYIHJlcXVpcm VzIGltcHJvdmVkIGZhaWxvdmVy
IHRlc3RpbmcgbWV0aG9kDQoNClRoaXMgRERUUyBoYXMgYmVlbi ByZXNvbHZlZCBhbmQgdGhlIGZp
eCB3aWxsIGJlIGF2YWlsYWJsZSBpbiBhbiB1cGNvbWluZw0Kdm Vyc2lvbiBvZiBzb2Z0d2FyZS4g
VGhlIHN0YW5kYnkgZmlyZXdhbGwgbm93IHZhbGlkYXRlcyBib3 RoIHRoZSBJUCBhZGRyZXNzIGFu
ZA0KTUFDIGFkZHJlc3Mgb2YgYWxsIGFjdGl2ZSBmaXJld2FsbC BpbnRlcmZhY2VzIHdoaWxlIGNv
bmR1Y3RpbmcgZmFpbG92ZXIgQVJQDQp0ZXN0aW5nLg0KDQogKi BDU0NzYzQ3NjE4IC0tIEF1dGhl
bnRpY2F0ZSBhbGwgbWVzc2FnZXMgYmV0d2VlbiBBY3RpdmUgYW 5kIFN0YW5kYnkgRmlyZXdhbGxz
DQoNClRoaXMgRERUUyBpcyB1bmRlciBpbnZlc3RpZ2F0aW9uIG FuZCB3aGlsZSBub3QgcmVzb2x2
ZWQgdGhlcmUgaXMgYSB3b3JrYXJvdW5kIHRvIA0KbWl0aWdhdG UgdGhlIGlzc3VlLg0KDQoNCldl
IHdvdWxkIGxpa2UgdG8gdGhhbmsgQW1pbiBUb3JhIGZvciByZX BvcnRpbmcgdGhpcyBpc3N1ZSB0
byB1cy4NCg0KV2UgZ3JlYXRseSBhcHByZWNpYXRlIHRoZSBvcH BvcnR1bml0eSB0byB3b3JrIHdp
dGggcmVzZWFyY2hlcnMgb24gc2VjdXJpdHkNCnZ1bG5lcmFiaW xpdGllcywgYW5kIHdlbGNvbWUg
dGhlIG9wcG9ydHVuaXR5IHRvIHJldmlldyBhbmQgYXNzaXN0IG luIHByb2R1Y3QNCnJlcG9ydHMu
DQoNCg0KQWRkaXRpb25hbCBJbmZvcm1hdGlvbg0KPT09PT09PT 09PT09PT09PT09PT09PQ0KDQpU
aGUgUmVsZWFzZSBOb3RlIEVuY2xvc3VyZSBmb3IgQ1NDc2MzND AyMiBzdGF0ZXM6DQorLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS 0tLS0tDQoNClN5bXB0b206DQor
LS0tLS0tLQ0KDQpUaGUgU3RhbmRieSBmaXJld2FsbCBpbiBmYW lsb3ZlciBwYWlyIG1heSBub3Qg
dGFrZSBvdmVyIHdoZW4gdGhlIEFjdGl2ZQ0KZmlyZXdhbGwgbG 9zZXMgcG93ZXIgb3IgY3Jhc2hl
cy4NCg0KDQpDb25kaXRpb25zOg0KKy0tLS0tLS0tLS0NCg0KRm 9yIHRoaXMgaXNzdWUgdG8gb2Nj
dXIsIGEgZHVwbGljYXRlIElQIGFkZHJlc3MgbWF0Y2hpbmcgb2 5lIG9mIHRoZSBhY3RpdmUNCmZp
cmV3YWxsJ3MgSVAgYWRkcmVzc2VzIG11c3QgYmUgcHJlc2VudC BvbiB0aGUgc2FtZSBuZXR3b3Jr
IHN1Ym5ldCBhcyB0aGUNCmZpcmV3YWxscyB3aGVuIHRoZSBhY3 RpdmUgZmlyZXdhbGwgbG9zZXMg
cG93ZXIgb3IgY3Jhc2hlcy4NCg0KV2hlbiB0aGUgYWN0aXZlIG ZpcmV3YWxsIGxvc2VzIHBvd2Vy
IG9yIGNyYXNoZXMsIHRoZSBzdGFuZGJ5IGZpcmV3YWxsJ3MgTE FODQpmYWlsb3ZlciBpbnRlcmZh
Y2Ugd2lsbCBsb3NlIGNvbm5lY3Rpdml0eSB3aXRoIHRoZSBhY3 RpdmUgZmlyZXdhbGwuIFRoaXMg
Y2F1c2VzDQp0aGUgc3RhbmRieSBmaXJld2FsbCB0byBBUlAgZm 9yIHRoZSBJUCBhZGRyZXNzIG9m
IGVhY2ggYWN0aXZlIGZpcmV3YWxsDQppbnRlcmZhY2UuIEJlY2 F1c2UgdGhlIGFjdGl2ZSBmaXJl
d2FsbCBpcyBub3cgdW5yZWFjaGFibGUsIHRoZSBkdXBsaWNhdG UgSVANCmFkZHJlc3MgbWF0Y2hp
bmcgdGhlIGFjdGl2ZSBmaXJld2FsbCB3aWxsIGNhdXNlIHRoZS BzdGFuZGJ5IGZpcmV3YWxsIHRv
IHJlY2VpdmUNCmEgcmVwbHkgdG8gdGhlIEFSUCBhdHRlbXB0Li BVcG9uIHJlY2VpdmluZyB0aGUg
ZXJyb25lb3VzICBBUlAgcmVwbHksIHRoZQ0Kc3RhbmRieSBmaX Jld2FsbCB3aWxsIGJlbGlldmUg
dGhhdCB0aGUgYWN0aXZlIGZpcmV3YWxsIGlzIHN0aWxsIHJlYW NoYWJsZSBhbmQNCnByZXZlbnQg
dGhlIHN0YW5kYnkgZmlyZXdhbGwgZnJvbSB0YWtpbmcgb3Zlci 4NCg0KRHVlIHRvIHRoZSB0aW1p
bmcgb2YgdHdvIGNvbmN1cnJlbnQgZmFpbG92ZXIgdGVzdHMsIH RoZXJlIGFyZSBzdGlsbCBjYXNl
cyB3aGVyZQ0KdGhlIHN0YW5kYnkgZmlyZXdhbGwgd2lsbCBiZS BhYmxlIHRvIGRldGVybWluZSB0
aGF0IHRoZSBhY3RpdmUgZmlyZXdhbGwgaXMgZG93bg0KZXZlbi B3aGVuIGEgZHVwbGljYXRlIElQ
IGFkZHJlc3MgaXMgcHJlc2VudDsgaG93ZXZlciwgdGhpcyBjYW 4gbm90IGJlDQpndWFyYW50ZWVk
Lg0KDQoNCldvcmthcm91bmQ6DQorLS0tLS0tLS0tLQ0KDQpDb2 5uZWN0aW5nIHRoZSBMQU4gZmFp
bG92ZXIgaW50ZXJmYWNlcyBvZiB0aGUgZmlyZXdhbGxzIHRvIH N3aXRjaCBwb3J0cyBtYXkNCm1p
bmltaXplIGJ1dCBub3QgY29tcGxldGVseSBtaXRpZ2F0ZSB0aG UgY2hhbmNlIHRoYXQgYW4gb3Ro
ZXJ3aXNlIGFjdGl2ZQ0KZmlyZXdhbGwgd2lsbCBsb3NlIGNvbm 5lY3Rpdml0eSB0byBpdHMgTEFO
IGZhaWxvdmVyIGludGVyZmFjZS4NCg0KUHJldmVudGluZyBvci Bjb3JyZWN0aW5nIElQIGFkZHJl
c3NlcyB0aGF0IGR1cGxpY2F0ZSB0aGUgZmlyZXdhbGwgSVAgYW RkcmVzc2VzDQppcyBhIGNvbXBs
ZXRlIHdvcmthcm91bmQgZm9yIHRoaXMgaXNzdWUuDQoNClRoZS BmaXJld2FsbCB3aWxsIGRldGVj
dCBhbmQgbG9nIGR1cGxpY2F0ZSBJUCBhZGRyZXNzZXMgd2l0aC BzeXN0ZW0gbG9nDQptZXNzYWdl
Og0KDQolUElYLTQtNDA1MDAxOiBSZWNlaXZlZCBBUlAgcmVzcG 9uc2UgY29sbGlzaW9uIGZyb20g
PGZpcmV3YWxsIElQIGFkZHJlc3MvbWFjDQphZGRyZXNzIG9mIG RldmljZSB3aXRoIGR1cGxpY2F0
ZSBJUCBhZGRyZXNzPiBvbiBpbnRlcmZhY2UgPGZpcmV3YWxsIG ludGVyZmFjZT4uDQoNCkFkZGl0
aW9uYWwgaW5mb3JtYXRpb24gYWJvdXQgdGhpcyBzeXNsb2cgbW Vzc2FnZSBpcyBhdmFpbGFibGUg
YXQ6DQpodHRwOi8vd3d3LmNpc2NvLmNvbS91bml2ZXJjZC9jYy 90ZC9kb2MvcHJvZHVjdC9tdWx0
aXNlYy9hc2Ffc3cvdl83MC9zeXNsb2cvbG9nbXNncy5odG0jd3 AxMjgyMjM0DQoNCkFkZGl0aW9u
YWwgaW5mb3JtYXRpb24gYWJvdXQgY29uZmlndXJpbmcgZmFpbG 92ZXIgaW4gUElYIGFuZCBBU0Eg
Ny4wIGlzDQphdmFpbGFibGUgYXQ6DQpodHRwOi8vd3d3LmNpc2 NvLmNvbS91bml2ZXJjZC9jYy90
ZC9kb2MvcHJvZHVjdC9tdWx0aXNlYy9hc2Ffc3cvdl83MC9jb2 5maWcvZmFpbG92ZXIuaHRtDQoN
CkFkZGl0aW9uYWwgaW5mb3JtYXRpb24gYWJvdXQgY29uZmlndX JpbmcgZmFpbG92ZXIgaW4gRldT
TSAyLjMgaXMgYXZhaWxhYmxlIGF0Og0KaHR0cDovL3d3dy5jaX Njby5jb20vdW5pdmVyY2QvY2Mv
dGQvZG9jL3Byb2R1Y3QvbGFuL2NhdDYwMDAvbW9kX2ljbi9md3 NtL2Z3c21fMl8zL2Z3c21fY2Zn
L2ZhaWxvdmVyLmh0bQ0KDQoNClRoZSBSZWxlYXNlIE5vdGUgRW 5jbG9zdXJlIGZvciBDU0NzYzQ3
NjE4IHN0YXRlczoNCistLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS 0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0NCg0KU3ltcHRvbToNCistLS0tLS0tDQoNCkFuIGF0dG Fja2VyIHdobyBjYW4gc3Bvb2Yg
dGhlIElQIGFkZHJlc3MgYW5kIE1BQyBhZGRyZXNzIG9mIGFuIG FjdGl2ZQ0KZmlyZXdhbGwncyBp
bnRlcmZhY2UgbWF5IHByZXZlbnQgZmFpbG92ZXIgZnJvbSBvY2 N1cnJpbmcuDQoNCkNvbmRpdGlv
bnM6DQorLS0tLS0tLS0tLQ0KDQpXaGVuIHRoZSBhY3RpdmUgZm lyZXdhbGwgbG9zZXMgcG93ZXIg
b3IgY3Jhc2hlcywgdGhlIHN0YW5kYnkgZmlyZXdhbGwncyBMQU 4NCmZhaWxvdmVyIGludGVyZmFj
ZSB3aWxsIGxvc2UgY29ubmVjdGl2aXR5IHdpdGggdGhlIGFjdG l2ZSBmaXJld2FsbC4gVGhpcyBj
YXVzZXMNCnRoZSBzdGFuZGJ5IGZpcmV3YWxsIHRvIEFSUCBmb3 IgdGhlIElQIGFkZHJlc3Mgb2Yg
ZWFjaCBhY3RpdmUgZmlyZXdhbGwNCmludGVyZmFjZS4gVGhlIH N0YW5kYnkgZmlyZXdhbGwgd2ls
bCBvbmx5IGFjY2VwdCB0aGUgQVJQIHJlc3BvbnNlIGlmIHRoZS Bzb3VyY2UNCk1BQyBhZGRyZXNz
IG1hdGNoZXMgdGhlIGFjdGl2ZSBmaXJld2FsbCdzIGludGVyZm FjZSBNQUMgYWRkcmVzcy4gQW4g
YXR0YWNrZXINCndobyBjYW4gc3Bvb2YgdGhlIElQIGFkZHJlc3 MgYW5kIE1BQyBhZGRyZXNzIG9m
IHRoZSBhY3RpdmUgZmlyZXdhbGwncyBpbnRlcmZhY2UNCmNhbi BsZWFkIHRoZSBzdGFuZGJ5IGZp
cmV3YWxsIHRvIGJlbGlldmUgdGhhdCB0aGUgYWN0aXZlIGZpcm V3YWxsIGlzIHN0aWxsDQpyZWFj
aGFibGUgYW5kIHByZXZlbnQgdGhlIHN0YW5kYnkgZmlyZXdhbG wgZnJvbSB0YWtpbmcgb3Zlci4N
Cg0KV29ya2Fyb3VuZDoNCistLS0tLS0tLS0tDQoNCkNvbmZpZ3 VyZSBwb3J0IHNlY3VyaXR5IG9u
IGFsbCBzd2l0Y2ggcG9ydHMgY29uZmlndXJlZCB0byBiZSBpbi B0aGUgc2FtZSB2bGFucw0KYXMg
dGhlIGFjdGl2ZSBhbmQgc3RhbmRieSBmaXJld2FsbHMgZW5hYm xlZCBpbnRlcmZhY2VzLiBQb3J0
IHNlY3VyaXR5IG11c3Qgbm90DQpiZSBlbmFibGVkIG9uIHRoZS Bzd2l0Y2ggcG9ydHMgY29ubmVj
dGVkIHRvIHRoZSBhY3RpdmUgYW5kIHN0YW5kYnkgZmlyZXdhbG xzDQppbnRlcmZhY2VzLg0KDQpQ
b3J0IHNlY3VyaXR5IHdpbGwgcHJldmVudCBhbiBhdHRhY2tlci Bmcm9tIHNwb29maW5nIHRoZSBh
Y3RpdmUgZmlyZXdhbGwncw0KaW50ZXJmYWNlIE1BQyBhZGRyZX NzIGFsbG93aW5nIGZhaWxvdmVy
IHRvIG9jY3VyIG5vcm1hbGx5Lg0KDQpUaGlzIGNvbmZpZ3VyYX Rpb24gc2hvdWxkIGJlIHRlc3Rl
ZCBiZWZvcmUgYmVpbmcgZW5hYmxlZCBpbiBhIHByb2R1Y3Rpb2 4NCmVudmlyb25tZW50Lg0KDQpG
b3IgaW5mb3JtYXRpb24gb24gY29uZmlndXJpbmcgcG9ydCBzZW N1cml0eSByZWZlciB0bzoNCiAg
IA0KQ2F0YWx5c3QgNjUwMCBTZXJpZXMgQ2lzY28gSU9TIFNvZn R3YXJlIENvbmZpZ3VyYXRpb24g
R3VpZGUNCkNvbmZpZ3VyaW5nIFBvcnQgU2VjdXJpdHkNCmh0dH A6Ly93d3cuY2lzY28uY29tL2Vu
L1VTL3Byb2R1Y3RzL2h3L3N3aXRjaGVzL3BzNzA4L3Byb2R1Y3 RzX2NvbmZpZ3VyYXRpb25fZ3Vp
ZGVfY2hhcHRlcjA5MTg2YTAwODAxNjBhMmMuaHRtbA0KDQoNCk NhdGFseXN0IDY1MDAgU2VyaWVz
IFNvZnR3YXJlIENvbmZpZ3VyYXRpb24gR3VpZGUNCkNvbmZpZ3 VyaW5nIFBvcnQgU2VjdXJpdHkN
Cmh0dHA6Ly93d3cuY2lzY28uY29tL2VuL1VTL3Byb2R1Y3RzL2 h3L3N3aXRjaGVzL3BzNzA4L3By
b2R1Y3RzX2NvbmZpZ3VyYXRpb25fZ3VpZGVfY2hhcHRlcjA5MT g2YTAwODAyMmYyN2IuaHRtbA0K
DQpMQU4gU2VjdXJpdHkNCkNvbmZpZ3VyYXRpb24gR3VpZGVzDQ podHRwOi8vd3d3LmNpc2NvLmNv
bS9lbi9VUy90ZWNoL3RrMzg5L3RrODE0L3RlY2hfY29uZmlndX JhdGlvbl9ndWlkZXNfbGlzdC5o
dG1sDQoNCkZvciBpbmZvcm1hdGlvbiBhYm91dCBsYXllciAyIG F0dGFja3MgYW5kIG1pdGlnYXRp
b25zIHJlZmVyIHRvOg0KDQpTQUZFIExheWVyIDIgU2VjdXJpdH kgSW4tZGVwdGggVmVyc2lvbiAy
DQpodHRwOi8vd3d3LmNpc2NvLmNvbS9lbi9VUy9uZXRzb2wvbn MzNDAvbnMzOTQvbnMxNzEvbnMx
MjgvbmV0d29ya2luZ19zb2x1dGlvbnNfd2hpdGVfcGFwZXIwOT E4NmEwMDgwMTQ4NzBmLnNodG1s
DQoNCg0KQ2lzY28gU2VjdXJpdHkgUHJvY2VkdXJlcw0KPT09PT 09PT09PT09PT09PT09PT09PT09
PQ0KDQpDb21wbGV0ZSBpbmZvcm1hdGlvbiBvbiByZXBvcnRpbm cgc2VjdXJpdHkgdnVsbmVyYWJp
bGl0aWVzIGluIENpc2NvIHByb2R1Y3RzLA0Kb2J0YWluaW5nIG Fzc2lzdGFuY2Ugd2l0aCBzZWN1
cml0eSBpbmNpZGVudHMsIGFuZCByZWdpc3RlcmluZyB0byByZW NlaXZlDQpzZWN1cml0eSBpbmZv
cm1hdGlvbiBmcm9tIENpc2NvLCBpcyBhdmFpbGFibGUgb24gQ2 lzY28ncyB3b3JsZHdpZGUgd2Vi
c2l0ZSBhdCANCmh0dHA6Ly93d3cuY2lzY28uY29tL2VuL1VTL3 Byb2R1Y3RzL3Byb2R1Y3RzX3Nl
Y3VyaXR5X3Z1bG5lcmFiaWxpdHlfcG9saWN5Lmh0bWwNCg0KVG hpcyBpbmNsdWRlcyBpbnN0cnVj
dGlvbnMgZm9yIHByZXNzIGlucXVpcmllcyByZWdhcmRpbmcgQ2 lzY28gc2VjdXJpdHkNCm5vdGlj
ZXMuIEFsbCBDaXNjbyBzZWN1cml0eSBhZHZpc29yaWVzIGFyZS BhdmFpbGFibGUgYXQgDQpodHRw
Oi8vd3d3LmNpc2NvLmNvbS9nby9wc2lydA0KDQoNCg0KUmVnYX JkcywgDQpSYW5keSANCg0KUmFu
ZHkgSXZlbmVyDQpQcm9kdWN0IFNlY3VyaXR5IEluY2lkZW50IF Jlc3BvbnNlIFRlYW0gKFBTSVJU
KQ0KQ2lzY28gU3lzdGVtcywgSW5jLg0Kcml2ZW5lckBjaXNjby 5jb20gDQpodHRwOi8vd3d3LmNp
c2NvLmNvbS9nby9wc2lydA0KDQotLS0tLUJFR0lOIFBHUCBTSU dOQVRVUkUtLS0tLQ0KVmVyc2lv
bjogUEdQIDguMQ0KDQppUUEvQXdVQlEza0Y2RzQvRXlERVdoOE lFUUtaUUFDZEZ3NGNPZEttQmR6
RzdPeFN2WTZCQnZQQ3JPRUFvT0Z6DQpKbE9IMjlaK1hkcklTZC tHZTJVYlJKMEgNCj0vSVd5DQot
LS0tLUVORCBQR1AgU0lHTkFUVVJFLS0tLS0NCg==

------_=_NextPart_001_01C5E965.956A6BDA--