- NANOG - lists.nanog.org

Security control in DSL access network
by Joe Shen 28 Mar '06

28 Mar '06

Hi, Is there any books or papers on carrier level DSL access network and LAN access network? Specifically, it should analysis the futures of DSL network and security problems in DSL networks. Joe __________________________________ Meet your soulmate! Yahoo! Asia presents Meetic - where millions of singles gather http://asia.yahoo.com/meetic

6 9

Telecom Convertors for DS1/DS3 signals
by Devon True 28 Mar '06

28 Mar '06

All: I am looking for recommendations for devices that can take a DS3 signal from a carrier via coax, convert it to optical so I can use fiber across buildings to transport the signal, and then on the other side, demux the DS3 signal to individual DS1 channels and terminate them on a RJ-48 port. Any suggestions? I am only looking at one DS3's worth of data to transport across buildings. Distance is around 1000 feet. Thanks! Devon

2 1

becoming a LEC
by Philip Lavine 27 Mar '06

27 Mar '06

I have decided to mux down a DS3 into T1's so that my vendors and customers have redundant access to my site. Here is the situation: Right now my customers/vendors ride the ILEC (I am in Burbank)into my building. I have another carrier with an OC3 running into my building so I wanted to take a DS3 off of that and then MUX that down to T1's so I can offer LEC diversity (and possibly upstream diversity). The alternate carrier has agreed to my plan but I am not sure if there is any regulations or standards that I must adhere to. Also how do I get my customers/vendors to choose me as the LEC when they order the redundant circuit? How do I create a LOA/CFA? Thanks, Philip __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

CISCO Hardware question for the masses..
by Micheal Patterson 27 Mar '06

27 Mar '06

Please forgive me if this is inappropriate for the list. We are looking to replace our current security solution with an ASA 5510. Per the info available from Cisco, this should fit the bill but I'm curious if any of you folks have these in place and if there are any gotcha's to it. -- Micheal Patterson .

1 0

RE: Fire in bakery fries fiber optic cable
by Robert Boyle 27 Mar '06

27 Mar '06

At 11:37 AM 3/27/2006, you wrote: >Speaking of Backhoes, there was a picture I had saved at one point, >can't find it now, maybe someone else has it.. > >It shows a backhoe, half-fallen down into a hole, on fire, huge tower of >flames coming up out of the hole. Sitting right next to the hole (this >picture was pre-popularity of photoshop, so I assume it to be legit) was >a big sign that said "Natural Gas Pipeline, do not dig". It was posted on underspace. http://www.underspace.com/UFM_files/photographs_page.php I don't see that photo there anymore, but it is a classic! :) -Robert > >Anyone who has this picture, email me offline. > >-donn Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com | 888-TELLURIAN | 973-300-9211 "Well done is better than well said." - Benjamin Franklin

1 0

RE: Fire in bakery fries fiber optic cable
by Lasher, Donn 27 Mar '06

27 Mar '06

>I used to have a customer who were in the forestry business. They had a hundred miles or so of railroad down South that >went from one of their sawmills to places that had lots of trees, and ran some telecom >cables along them. Where they had bridges, the cables would hang >underneath the bridges. They had some cable problems during the rainy season, due to wetness, but they also ran into >problems during hunting season with guys named Bubba who'd shoot at birds on their cables (presumably when they were >taking a break from their day job of driving backhoes...) Speaking of Backhoes, there was a picture I had saved at one point, can't find it now, maybe someone else has it.. It shows a backhoe, half-fallen down into a hole, on fire, huge tower of flames coming up out of the hole. Sitting right next to the hole (this picture was pre-popularity of photoshop, so I assume it to be legit) was a big sign that said "Natural Gas Pipeline, do not dig". Anyone who has this picture, email me offline. -donn

1 0

Fire in bakery fries fiber optic cable
by Sean Donelan 27 Mar '06

27 Mar '06

http://timesunion.com/AspStories/story.asp?storyID=463928&category=BUSINESS… A fire Tuesday that tore through a popular bakery in Cohoes left 70,000 Time Warner Cable subscribers without TV service. Some who also rely on the cable company for their high-speed Internet or telephone found all three out of commission. In the pictures, it appears electric, telephone and cable lines were all on the utility poles damaged by the fire. I'm not sure why time-warner cable had the brunt of the outages in the newspaper reports. It may have just been bad luck on which company's lines got baked (sorry, more bad puns).

5 5

SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow)
by Gadi Evron 27 Mar '06

27 Mar '06

Tech details: Sendmail vulnerabilities were released yesterday. No real public announcements to speak of to the security community. SecuriTeam released some data: "Improper timeout calculation, usage of memory jumps and integer overflows allow attackers to perfom a race condition DoS on sendmail, and may also execute arbitrary code." More here: http://www.securiteam.com/unixfocus/5RP0L0UI0S.html ISS only reported the Race Condition (DoS?). The Sendmail Advisory reported the Race Condition DoS, the Memory Jumps and a "theoretical" Integer Overflow. To begin with, anyone noticed the memory leak they (Sendmail) silently patched? I wonder how many other unreported silently-patched vulnerabilities are out there? Second, the Integer Overflow is practical, not theoretical. ISS reported the Race Condition last mounth. There is NO data available on when the other vulnerabilities were discovered. Any guesses? They also patched many non-security related bugs, added checks and more informative error messages, etc. Sendmail is, as we know, the most used daemon for SMTP in the world. This is an International Infrastructure vulnerability and should have been treated that way. It wasn't. It was handled not only poorly, but irresponsibly. Here's what ISS releasing the Race Condition vulnerability has to say: http://xforce.iss.net/xforce/alerts/id/216 They say it's a remote code execution. They say it's a race condition. No real data available to speak of. I can't see how it's remotely exploitable, but well, no details, remember? From what we can see it seems like a DoS. Bottom line ----------- What they did behind the smoke-screen is replace a lot of setjmp() and longjmp() functions (not very secure ones at that) with goto's (interesting choice). They changed the logic of the code, replaced everything that calculated timeout. Anything that calculated something and returned a value now returns a boolean result, when previously they just returned void. They used to look at the content rather than success. The int overflow is possibly exploitable, not very sure about the jumps. No idea why ISS says the Race Condition is, would love insight. Public announcement ------------------- FreeBSD were the only ones who released a public announcement of a patch and emailed it to bugtraq so far. The patches ----------- The FreeBSD patch much like the sendmail.org patch is very long, complicated and obscure. The release was made along with a ton of other patches for FreeBSD. Go figure what's in there. Sendmail.com's patch is so big they may as well have re-released the whole program. There are also patches available for other *nix systems, no distributions released updates yet. Sendmail's announcement ----------------------- Obscure. Not worth any other comments other than the ones above. CVE information --------------- CVE-2006-0058 (reserved) Commentary ---------- One could say ISS and Sendmail did good, obscuring the information so that the vulnerability-to-exploit time will be longer. That proved wrong, useless and pointless. They failed. After looking at the available data for 30 minutes (more or less), we know exactly what the vulnerabilities are. Exploiting them may not be that trivial if indeed possible, but there are most likely already exploits out there if it is. When will the first public POC be released? Your guess is as good as mine. Not to mention the silently patched memory leak. SMTP and Sendmail by extension are critical for the Internet as an International Infrastructure. If this ends up being exploitable (no details, remember?) both ISS and Sendmail should look good and hard at the coming massive exploitation of Sendmail servers. With issues relating to the Internet Infrastructure I'd be willing to go even with the evil of non-disclosure, as long as something gets done and then reported publically when it finally scaled down in a roll-back after a couple of years. If not, and you are going to make it public, make the effort and fix it as soon as you can, and give information to help the process of healing. Don't do it a mounth late and obscure data. It took Sendmail a mounth to fix this. A mounth. A mounth! With such Vendor Responsibility, perhaps it is indeed a Good Thing to go Full Disclosure. It seems like history is repeating itself and Full Disclosure is once again not only a choice, but necessary to make vendors become responsible. I wish we could somehow avoid all the guys who will inevitably shout in the press "end of the world". The Internet is, was and will stay havoc. There will be exploitation. Those who care about security will be patched, those that don't will hopefully finally learn a lesson. The Internet won't die because of this, although email may suffer ? but we are used to that by now, even when losing money. I am so very angry the details are obscure and hidden in the way they are, especially as that is useless in this case. Why did they do it, to claim they are ?responsible?? Too late. "The avalanche has already started. It is too late for the pebbles to vote." - Kosh, Babylon 5. How are they to show open source is reliable if this is how they act? They hurt the cause. If they don't know how to handle something like this, they should ask for help. What, if it's not reported to Microsoft, there is no reason to be ?responsible?? It's like annoying "fake porn" on TV. Either show the nudity and rate the program accordingly or stay suitable for normal viewing. There is no eating the cake and leaving it whole. "Hey mom, what's my root password? I forgot" "Dunno, just use the new sendmail vulnerability!" They should learn from Apache. With such a critical vulnerability I know the Apache guys would not have slept until it is patched! We will update on the situation if required on http://blogs.securiteam.com This text can be found here: http://blogs.securiteam.com/index.php/archives/363 Gadi Evron.

9 20

Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow)
by Brandon Butterworth 27 Mar '06

27 Mar '06

> There are two exploit code samples I saw. There are two remote exploits > for one of them so far that are public that I know of. Please provide reference URLs or the code, if not then stop spreading FUD. Bugs happen, deal with them and move on. The endless whine is more annoying (as are 20 vendor notifications for the same bug each with their own spin/marketing, especially when they're all Linux with a different badge) brandon

6 7

Re: Fire in bakery fries fiber optic cable
by Mark Smith 26 Mar '06

26 Mar '06

On Sat, 25 Mar 2006 18:16:34 -0500 Aaron Gagnier <agagnier(a)fsck.ca> wrote: > This one? > > http://www.dslreports.com/forum/remark,2471255~root=cable,opt~mode=flat > Could be. Keith Woodworth sent me this version of it off list : http://please.rutgers.edu/show/broadband/fibercable.jpg I seem to remember it being on some sort of fault report, maybe that is a copy of the original photo. Thanks, Mark. -- "Sheep are slow and tasty, and therefore must remain constantly alert." - Bruce Schneier, "Beyond Fear"

4 4