Re: Cisco IOS Vulnerability (going OT)

2003-07-16 Thread Petri Helenius
> > 1) I didn't make this > 2) I cna't remmber where i got it from > 3) please don't abuse my connection too much tonight > There is another thing to play when reloading boxes, above disclaimers 1 and 2 apply. http://www.he.iki.fi/favorites.mpeg Pete

Re: Cisco IOS Vulnerability

2003-07-16 Thread Jeff Kell
The workaround for transit suggests permitting only tcp, udp, icmp, gre, esp, and ah protocols. Is this sufficient to protect the router itself, or do you have to get hard-nosed with specific ACLs (restricting access to all your possible interface addresses)? Jeff

RE: Cisco IOS Vulnerability

2003-07-16 Thread Darrell Kristof
If Cisco made THIS big a deal of this to not release info to the public, I wouldn't wait. There must be a reason. I had to push and push to get any info and I think they finally gave up because too many people knew. If you notice http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.s

Re: Cisco IOS Vulnerability

2003-07-16 Thread Ryan Tucker
On Thu, 17 Jul 2003 01:09:36 -0400, Jared Mauch <[EMAIL PROTECTED]> wrote: http://puck.nether.net/~jared/gigflapping.mp3 Mirrored at http://www.netacc.net/~rtucker/gigflapping.mp3 ... same disclaimers as Jared gives, but I have more bandwidth. :-) -rt (what do you mean I need a new chassis?)

RE: Cisco IOS Vulnerability

2003-07-16 Thread Sean Donelan
On Thu, 17 Jul 2003, Mikael Abrahamsson wrote: > On Wed, 16 Jul 2003, Darrell Kristof wrote: > > Cisco Security Advisory: Cisco IOS Interface Blocked by IPv4 Packet > > http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml > > IS anyone seeing this exploited in the wild? It'd be goo

Re: Cisco IOS Vulnerability

2003-07-16 Thread Jared Mauch
On Thu, Jul 17, 2003 at 07:48:24AM +0200, Mikael Abrahamsson wrote: > > On Wed, 16 Jul 2003, Darrell Kristof wrote: > > > > > Cisco Security Advisory: Cisco IOS Interface Blocked by IPv4 Packet > > http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml > > IS anyone seeing this e

RE: Cisco IOS Vulnerability

2003-07-16 Thread Mikael Abrahamsson
On Wed, 16 Jul 2003, Darrell Kristof wrote: > > Cisco Security Advisory: Cisco IOS Interface Blocked by IPv4 Packet > http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml IS anyone seeing this exploited in the wild? It'd be good to know if we need to do panic upgrade or can sch

Flapping (was Re: Cisco IOS Vulnerability)

2003-07-16 Thread Sean Donelan
On Thu, 17 Jul 2003, Jason Lixfeld wrote: > This wouldn't be the "My gig port's down, and now it's up again..." > song would it? :) Folks may remember when ISPs were responding to the SNMP vulnerability many backbones were rebooting their routers during maintenance windows. At the time, some pe

RE: Cisco IOS Vulnerability

2003-07-16 Thread Todd Mitchell - lists
| -Original Message- | From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of | Jared Mauch | Sent: Thursday, July 17, 2003 1:10 AM | To: Jason Lixfeld | Cc: joshua sahala; '[EMAIL PROTECTED]' | Subject: Re: Cisco IOS Vulnerability | | | On Thu, Jul 17, 2003 at 01:02:42AM -0400

Re: Cisco IOS Vulnerability

2003-07-16 Thread Jason Lixfeld
So that was the one... On Thursday, July 17, 2003, at 1:09 AM, Jared Mauch wrote: On Thu, Jul 17, 2003 at 01:02:42AM -0400, Jason Lixfeld wrote: On Wednesday, July 16, 2003, at 11:34 PM, joshua sahala wrote: anyone have the 'scheduled maintenance" mp3 lying around? i have a feeling i am going

Re: Cisco IOS Vulnerability

2003-07-16 Thread Christopher L. Morrow
On Thu, 17 Jul 2003, Jared Mauch wrote: > > On Thu, Jul 17, 2003 at 01:02:42AM -0400, Jason Lixfeld wrote: > > > > > > On Wednesday, July 16, 2003, at 11:34 PM, joshua sahala wrote: > > > > >anyone have the 'scheduled maintenance" mp3 lying around? i have a > > >feeling i am going to need it >

Re: Cisco IOS Vulnerability

2003-07-16 Thread Jared Mauch
On Thu, Jul 17, 2003 at 01:02:42AM -0400, Jason Lixfeld wrote: > > > On Wednesday, July 16, 2003, at 11:34 PM, joshua sahala wrote: > > >anyone have the 'scheduled maintenance" mp3 lying around? i have a > >feeling i am going to need it > > This wouldn't be the "My gig port's down, and now it

megapath.net dns

2003-07-16 Thread Len Rose
Can someone with a clue at megapath.net PLEASE fix your dns. I've been sending mail to noc@ for the last 24 hours but all I get are auto responder messages. Your forward zones don't match your reverse zones for mia.megapath.net and 74.33.69.in-addr.arpa zones. You are causing denial of servic

Re: Cisco IOS Vulnerability

2003-07-16 Thread joshua sahala
On Wednesday 16 July 2003 23:18, Jared Mauch wrote: > On Wed, Jul 16, 2003 at 10:11:49PM -0500, Darrell Kristof wrote: > > Cisco has posted information regarding this issue and work > > arounds. 12.3 based code does not exhibit this problem. > > > > Cisco Security Advisory: Cisco IOS Interface Blo

Re: Cisco IOS Vulnerability

2003-07-16 Thread Jared Mauch
On Wed, Jul 16, 2003 at 10:11:49PM -0500, Darrell Kristof wrote: > > Cisco has posted information regarding this issue and work arounds. > 12.3 based code does not exhibit this problem. > > Cisco Security Advisory: Cisco IOS Interface Blocked by IPv4 Packet > http://www.cisco.com/warp/public/7

RE: Cisco IOS Vulnerability

2003-07-16 Thread Darrell Kristof
Cisco has posted information regarding this issue and work arounds. 12.3 based code does not exhibit this problem. Cisco Security Advisory: Cisco IOS Interface Blocked by IPv4 Packet http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml - Darrell -Original Message- Fr

IOS Vulnerability

2003-07-16 Thread Scott McGrath
For full details about the vulnerability see http://www.cisco.com/en/US/products/hw/routers/ps341/products_security_advisory09186a00801a34c2.shtml Scott C. McGrath

Cisco IOS Vulnerability

2003-07-16 Thread John Timmons
i have no details regarding the ios vulnerability other than what has already been stated on-list, but the IOS matrix obtained this evening and listed at http://www.0ptical.net/cisco.html shows what versions are affected, and what to upgrade to resolve the mystery issue. not sure why psirt is

Re: New Cisco Vulnerability

2003-07-16 Thread John Curran
Title: Re: New Cisco Vulnerability Hello All,   There seem to be rumors going around that there is  a new major Cisco vulnerability but only the major backbones are being given  fixes right now.   Something about packets malformed in a certain  manner cause the router to wedge.   Can anyne shed a

Re: New Cisco Vulnerability

2003-07-16 Thread Michael Sinatra
On Wed, 16 Jul 2003, Eric Gauthier wrote: > Ok, fine, don't tell the rest of use what it is, how to detect it, or how > to defend against it. We in the university space will just do nothing because > we have nothing to put into our IDS sensors to watch for/block it out. > Because, you know, we

Re: New Cisco Vulnerability

2003-07-16 Thread Eric Gauthier
> > This might explain the (very!) high number of maintenance alerts from > > QWest this week, as well > > > Sprint, L3 and Cogent also announced a series of emergency maintenances. Ok, fine, don't tell the rest of use what it is, how to detect it, or how to defend against it. We in the un

Re: New Cisco Vulnerability

2003-07-16 Thread Petri Helenius
> > > I'm hearing similar rumors, and Genuity has a "planned emergency > > maintenance" tomorrow morning, and there's some major weirdness with > > our AT&T feed over the past half hour. > > > This might explain the (very!) high number of maintenance alerts from > QWest this week, as well

RE: Postini's network.

2003-07-16 Thread Gary Attard
AT & T Master Trouble Ticket is 1537072 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jerry B. Altzman Sent: Wednesday, July 16, 2003 4:52 PM To: Darren Bolding Cc: 'Drew Weaver'; [EMAIL PROTECTED] Subject: Re: Postini's network. Darren Bolding wrote:

Re: Postini's network.

2003-07-16 Thread Jerry B. Altzman
Darren Bolding wrote: There appears to have been some difficulty inside ATT's network the last few minutes. It appears to have been resolved. I don't have a master-ticket number or such yet. Try 201975 --D //jbaltz -- jerry b. altzman[EMAIL PROTECTED]+1 646 230 8750 Thank you for

Re: New Cisco Vulnerability

2003-07-16 Thread David Raistrick
> I'm hearing similar rumors, and Genuity has a "planned emergency > maintenance" tomorrow morning, and there's some major weirdness with > our AT&T feed over the past half hour. This might explain the (very!) high number of maintenance alerts from QWest this week, as well --- david raistr

RE: Postini's network.

2003-07-16 Thread Gary Attard
There is currently an AT & T OC192 down from St Louis to San Francisco (Big Pipe: OC-192=9.952 Gbps) -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Drew WeaverSent: Wednesday, July 16, 2003 4:29 PMTo: '[EMAIL PROTECTED]'Subject: Postini's network.  

Re: New Cisco Vulnerability

2003-07-16 Thread Jay Hennigan
On Wed, 16 Jul 2003, John Payne wrote: > --On Wednesday, July 16, 2003 12:50 PM -0700 Gregory Hicks > <[EMAIL PROTECTED]> wrote: > > > > >> From: "Vincent J. Bono" <[EMAIL PROTECTED]> > >> Date: Wed, 16 Jul 2003 15:17:54 -0400 > >> > >> Hello All, > >> > >> There seem to be rumors going around th

Re: Postini's network.

2003-07-16 Thread Scott Francis
On Wed, Jul 16, 2003 at 01:10:17PM -0700, [EMAIL PROTECTED] said: > >There appears to have been some difficulty inside ATT's network the >last few minutes. It appears to have been resolved. I don't have a >master-ticket number or such yet. yeah, we had a tunnel into ATT that disappe

RE: Postini's network.

2003-07-16 Thread Darren Bolding
There appears to have been some difficulty inside ATT's network the last few minutes.  It appears to have been resolved.  I don't have a master-ticket number or such yet.   FYI.   --D From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Drew WeaverSent: Wednesday,

Re: New Cisco Vulnerability

2003-07-16 Thread John Payne
--On Wednesday, July 16, 2003 12:50 PM -0700 Gregory Hicks <[EMAIL PROTECTED]> wrote: From: "Vincent J. Bono" <[EMAIL PROTECTED]> Date: Wed, 16 Jul 2003 15:17:54 -0400 Hello All, There seem to be rumors going around that there is a new major Cisco vulnerability but only the major backbones ar

Postini's network.

2003-07-16 Thread Drew Weaver
    Is anyone else having trouble reaching postini?   Tracing route to coax.net.coax.mail1.psmtp.com [12.158.34.245] over a maximum of 30 hops:     1    <1 ms    <1 ms    <1 ms  gateway.cmh.ee.net [209.190.0.1]   2    <1 ms    <1 ms    <1 ms  letmeout.thenap.com [206.222.25.1]

Re: New Cisco Vulnerability

2003-07-16 Thread Gregory Hicks
> From: "Vincent J. Bono" <[EMAIL PROTECTED]> > Date: Wed, 16 Jul 2003 15:17:54 -0400 > > Hello All, > > There seem to be rumors going around that there is a new major Cisco > vulnerability but only the major backbones are being given fixes > right now. Not 100% true... Anyone with a Catalyst

Re: New Cisco Vulnerability

2003-07-16 Thread Petri Helenius
It supposedly requires 75 packets which is the default amount of slots in the "process switched" input queue on an interface. There have been packets stuck in the input queue in previous occasions but I suspect this is readily exploitable remotely.   Pete   - Original Message -

New Cisco Vulnerability

2003-07-16 Thread Vincent J. Bono
Hello All,   There seem to be rumors going around that there is a new major Cisco vulnerability but only the major backbones are being given fixes right now.   Something about packets malformed in a certain manner cause the router to wedge.   Can anyne shed any light on or off list?   -vb  

NTPv3 stratum-1 with MD5 availability

2003-07-16 Thread John Kristoff
We're reworking our current NTP infrastructure and are looking for public NTP stratum-1 servers (we don't currently have the resources to run our own stratum-1 at this time) that are willing to allow one of our stratum-2's to get and distribute time from. We'd like to use MD5 authentication and s

Re: qmail smtp-auth bug allows open relay

2003-07-16 Thread Jack Bates
Margie Arbon wrote: Check your mail logs campers. You're joking, right? *headache just thinking about those logs* -Jack