March 2014 - NANOG - lists.nanog.org

Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 26 Mar '14

26 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability Advisory ID: cisco-sa-20140326-sip Revision 1.0 For Public Release 2014 March 26 16:00 UTC (GMT) Summary ======= A vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device. To exploit this vulnerability, affected devices must be configured to process SIP messages. Limited Cisco IOS Software and Cisco IOS XE Software releases are affected. Cisco has released free software updates that address this vulnerability. There are no workarounds for devices that must run SIP; however, mitigations are available to limit exposure to this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The March 26, 2014, Cisco IOS Software Security Advisory bundled publication includes six Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2014 bundled publication. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar14.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJTMeUuAAoJEIpI1I6i1Mx3NjYP/0etuiRKILQ2sFGrwyA+vUc+ af04L8J24D4/7/qQJ9YsZekjol0u0+vJIhHEMzqeRKiv4qUwHudtzgDLn6svASRR djFwz5QzPkrheF/Xk+tKT4NkDcPrr4MWH5j8zRltfYdRgQHVzGeV7u6JorOAlV3b m8Tkg6+sl4rTBw0tky8swM5H35p9UOnDzlFlzx6WNUGZFrv83wbj9L2ZdcDzXSdl 0jXw1xue9DEpksC3A2KNq9zIrizEJGfx97jhhRG0OsK/3gbO3ESFGr6wbkakLZNS WJmCgk82tiT2mM8/FulyPvdpuDAc5y0br+W0I0O0gABZmOoix0DT3NlJXh5hd48y 5iJ5s15D0Og3jJq3nzC8U2za+lMLcDsm4WGgWsY7UvzMWJ24u1Q4LP0Ios5r7bHV MF9CyWSxxqFO3pWBQw53HZhBDmk4rl3iDHSAytHVEjNlrmKAY/Q5MHZpMER1yQIO O9ER61S6eXTS6yCcoFf7cpdBvZR08C9PS/geOmv+5znJ4AbpzCdrQYUDZlcL/DhW jGZ/cvgytw3zPYozPYSFqnB/aadcA3xHeTjba9qsHlo8tAlJqUGIlIzzGsag1yuW rUSjLrnEUDiy0cGxq/tZsERiyUVWtafsc/F6/dshp27LB7Ih8ulOvpTEIMzZKAnv 8sx8s3vq7KEIpWUpj1ak =e0Cj -----END PGP SIGNATURE-----

1 0

BiLateral Transit Agreements?
by Jack Bates 26 Mar '14

26 Mar '14

Does anyone have experience with BiLateral Transit Agreements, compared to the same with Peering Agreements? I have 2 ISP customers that are looking at such an agreement. While I can modify the standard BLPA templates to support transit provisions, I was curious if anyone had done so and what pitfalls to look for or considerations that should be made. Our particular case is high cost transport, so both companies are looking at each having a Tier 1 transit and then supporting the second through their agreement. Jack Bates

1 0

Assistance Exporting MRTG graph data
by Joseph M. Owino 26 Mar '14

26 Mar '14

Hi, I recently changed my monitoring server and would like to know how someone can export MRTG data so that there are no breaks in the graph data? regards Joseph Muga Owino Technical Officer TESPOK Cell: 0721-930-681 twitter.com/jpmuga Zimbra Blog: Celebrate! It’s Community Manager Appreciation Day! http://bit.ly/1e3C1cq

2 1

DNSSEC in .au
by Adam King 26 Mar '14

26 Mar '14

auDA has announced it will be introducing DNSSEC into the .au domain space in an experimental capacity. Deployment on production servers will commence during April and will be trialled for 4 months. The .au DS records will_not be added to the root zone during this period. Operators should_not create or implement trust anchors for .au in their production environments during this experimental phase. A mailing list has been created for all future announcements related to DNSSEC in .au, if you wish to subscribe to this mailing list please visit http://www.lists.auda.org.au/mailman/listinfo/dnssec-announce For further information about the implementation of DNSSEC in .au please see http://www.auda.org.au/industry-information/au-domains/dnssec/. Kind Regards, Adam King | CTO .au Domain Administration Ltd T: +61 3 8341 4111 | F: +61 3 8341 4112 E: adam.king(a)auda.org.au | W:www.auda.org.au Twitter: @auda | Blog: www.auda.org.au/blog/ auDA - Australia's Domain Name Administrator Important Notice This email may contain information which is confidential and/or subject to legal privilege, and is intended for the use of the named addressee only. If you are not the intended recipient, you must not use, disclose or copy any part of this email. If you have received this email by mistake, please notify the sender and delete this message immediately.

2 1

Re: arin representation
by Larry Sheldon 25 Mar '14

25 Mar '14

On 3/25/2014 11:53 AM, Bob Evans wrote: > I like term limits for every governing body - except when it's a company I > built with my money. :-) I have absolutely no business jumping into this discussion, but it keeps hammering on a topic that interests me in other venues: "term limits". I am opposed to them, assuming that the election process is open and honest and the voters have an opportunity to be informed. (And if it is not, THAT is what needs to be fixed.) It is my opinion that every discussion of the "need" for term limits involves a person or group of people who have these important characteristics: They propose and vote in favor of legislation or do something else the term-limiters don't like. Their constituency DOES like what they do and signal that by re-electing them. State Senator Ernie Chambers here in Nebraska should be the text-book example of the evils of term limits. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

How robust is the V6 to V4 infrastructure?
by Naslund, Steve 25 Mar '14

25 Mar '14

A question came to mind with all the discussion of ipv6 vulnerabilities. I am wondering for those with a lot of real world pure IPv6 connectivity, how robust have been the V6 to V4 gateways necessary for intercommunication between native IPv6 hosts and the IPv4 world? I was thinking that going to native ipv6 depends heavily on these gateways being reachable and having fairly high performance characteristics. How are the service providers doing providing these services? Steven Naslund Chicago IL

1 0

Anyone from megapth networks?
by Lou Katz 25 Mar '14

25 Mar '14

Please contact me offlist about an NTP attack. -- -=[L]=- Composed on an ASR33 Linux? Is that an OS, like Pentium?

1 0

ms word
by Randy Bush 25 Mar '14

25 Mar '14

this would be a good time to tll your users not to send or open ms word documents. active 0day http://arstechnica.com/security/2014/03/zero-day-vulnerability-in-microsoft… randy

2 1

Ipv4 end, its fake.
by Bryan Socha 25 Mar '14

25 Mar '14

As someone growing in the end of ipv4, its all fake. Sure, the rirs will run out, but that's boring. Don't believe the fake auction sites. Fair price of IP at the end is $1 for bad Rep $2 for barely used, $3 for no spam and $4 for legacy. Stop the inflation. Millions of IPS exist, there is no shortage and don't lie for rirs with IPS left.

10 10

Re: Level 3 blames Internet slowdowns on Technica
by Larry Sheldon 24 Mar '14

24 Mar '14

On 3/21/2014 9:13 AM, Sholes, Joshua wrote:> How do you get around the problem of natural monopolies, then? My strongly held belief is that if the "natural" monopoly* becomes oppressive somebody in their garage will find another way, and absent regulation and force of arms available to the "natural" monopoly, eliminate the monopoly situation and maybe the "natural" monopolist. Or should > we be moving to a world where, say, a dozen or more separate companies are > all running fiber or coax on the poles on my street in an effort to get to > my house? Could be--we have two energy companies at our house. And two communications companies have boxes on the back wall. Beyond the piped-in water service, we have several competing beverage sources (including for water) in service. The house across the street has, it appears, at least three companies providing TV service (and Internet service?). Three outfits provide waste disposal service in the neighborhood, although I am not bright enough to see a competitor for the sewage component. I wasn't bright enough to see the World Wide Web, either. Nobody uses poles. > IMHO, the only way to get real competition on the last mile is to have the > actual fiber/wire infrastructure being owned by a neutral party that's > required to pass anyone's traffic. As soon as "required" is in the discussion, we have a monopoly, and a monopoly has the power to abuse the situation. Wire and glass are not the only media available, as if that mattered. And we already have duplicates; what is the big deal? OH! And the reason why one set of wires is idle, is that provider got beat by the completion on the other set. (For this discussion, coaxial cable is a "set of wires".) *too old, failing memory and all, I'll have to go read up on "natural monopoly"--I can not think of one that does not require regulation and force of arms to exist. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

8 7