Re: IOS exploit: please disclose vehicle, not mechanism

Article View: comp.dcom.sys.cisco

Article #2243

Back to comp.dcom.sys.cisco Previous Next

#2243

From: jankemi(remove)
Date: Thu, 24 Jul 2003 00:07

35 lines
2481 bytes

Bill Johnston wrote:
> [posted and mailed]
> 
> I've read the alerts from Cisco, SANS, and CERT
> regarding the latest IOS flaw, which identify 
> only the potential for denial of service attacks
> to be directed at certain well-known TCP ports.
> 

IP Protocols, not TCP ports.

> A SAN "Flash" publication noted that an exploit
> had been observed "in the wild".  Unfortunately,
> it neglected to describe the vehicle for this 
> exploit in even a basic way that could help 
> Cisco admins plan a rational IOS migration 
> strategy.  
> 

Cisco's alert was revised last week to include specific ACL's that will 
stop the attack. Our ACL's went in last Thursday evening.

[snip]

> "Go upgrade EVERYTHING", just isn't an adequate
> set of marching orders.  Even if that is the 
> ultimate goal, one must have some information 
> if one is to plan, prioritize, and execute a 
> rational response.
> 
> - Bill

The information exists in Cisco's announcment.

--Mike

Technical Details

Message-ID: <LqFTa.116237$wk6.30285@rwcrnsc52.ops.asp.att.net>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!headwall.stanford.edu!newshub.sdsu.edu!elnk-nf2-pas!newsfeed.earthlink.net!wn14feed!worldnet.att.net!204.127.198.203!attbi_feed3!attbi_feed4!attbi.com!rwcrnsc52.ops.asp.att.net.POSTED!not-for-mail

References: <Xns93C1BACF3C55Awdjohnstoncomcastnet@206.127.4.25>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,536b22101f44acbf
X-Google-Attributes: gidf922c,public
X-Google-Thread: 114395,536b22101f44acbf
X-Google-Attributes: gid114395,public
X-Google-Thread: 102702,536b22101f44acbf
X-Google-Attributes: gid102702,public
X-Google-ArrivalTime: 2003-07-23 17:07:07 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!headwall.stanford.edu!newshub.sdsu.edu!elnk-nf2-pas!newsfeed.earthlink.net!wn14feed!worldnet.att.net!204.127.198.203!attbi_feed3!attbi_feed4!attbi.com!rwcrnsc52.ops.asp.att.net.POSTED!not-for-mail
From: "jankemi(remove)" <"jankemi(remove)"@mail.com>
User-Agent: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:1.4) Gecko/20030701
X-Accept-Language: en-us, en
MIME-Version: 1.0
Newsgroups: comp.dcom.sys.cisco,ios.general,comp.security.firewalls
Subject: Re: IOS exploit: please disclose vehicle, not mechanism
References: <Xns93C1BACF3C55Awdjohnstoncomcastnet@206.127.4.25>
In-Reply-To: <Xns93C1BACF3C55Awdjohnstoncomcastnet@206.127.4.25>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Lines: 36
Message-ID: <LqFTa.116237$wk6.30285@rwcrnsc52.ops.asp.att.net>
NNTP-Posting-Host: 24.245.5.3
X-Complaints-To: abuse@comcast.net
X-Trace: rwcrnsc52.ops.asp.att.net 1059005227 24.245.5.3 (Thu, 24 Jul 2003 00:07:07 GMT)
NNTP-Posting-Date: Thu, 24 Jul 2003 00:07:07 GMT
Organization: Comcast Online
Date: Thu, 24 Jul 2003 00:07:07 GMT

Reply to Parent Message