Well, the point was made in my office on Friday that the upgrade was not just snmp or sshd but that they were required to upgrade the core operating code. This suggests to me that it's something to do with packets or packet handling, not with services. Which makes me all the more concerned. Of course, it will probably be something along the lines of "When reciving a packet with such and such format with some particular service enabled, the router might reload under specific conditions" or some such thing that will not affect many people other than the tier 1s who work their routers way harder than any of us lilliputians.
On Mon, Jan 24, 2005 at 07:09:56PM +1100, Colin Neeson wrote: > > > > I agree - this would not be a defect that would require backbone maintenance > - it's a defect that would affect edge VOIP devices, hardly core > infrastructure. > > Of course, it could be that there is another more serious defect out there > that major providers have been pre-warned about and are deploying > countermeasures prior to a general disclosure (ALA SNMP vulnerabilities). > > We'll have to wait and see. > > > On 24/1/05 6:49 PM, "Alexei Roudnev" <[EMAIL PROTECTED]> wrote: > > > > > I do not expect, that any carriet took this as an emergency - defect is > > quite harmless (DOS in the worst case, + no exploits known, + no any > > interest for anyone to do it, + VoIP gateways involved only...). Even if > > someone is doing maintanance, it can be noticed by VoIP network users only. > > > > Moreover, correct me if it was not defect in Cisco express call center (call > > center @ IOS) - I can not image carriers using this (it was designed for > > small businesses). > > > > Why to get simple, relatively harmless (require ugrade in next scheduled > > time, usually 1 - 3 weeks) defect as a terrible threat to everyone? Even BGP > > problem was much more dangerous (and no single case known since this, so it > > was not emergency as well).. > > > > ----- Original Message ----- > > From: "Darrell Kristof (CE CEN)" <[EMAIL PROTECTED]> > > To: <nanog@merit.edu> > > Sent: Saturday, January 22, 2005 7:52 PM > > Subject: Emergency Internet Backbone Provider Maintenance Tonight > > > > > --- Wayne Bouchard [EMAIL PROTECTED] Network Dude http://www.typo.org/~web/
