July 2003 - Test - lists.nanog.org

RE: Cisco vulnerability on smaller catalyst switches
by Steve Rude 18 Jul '03

18 Jul '03

>> I tested Catalyst 2924-XL-EN with 12.0(5)WC5a and I found that without >> L3 capability it does not seem to be affected. But with L3 >> connectivity, if you direct the attack at the VLAN1 interface it is >> definitely susceptible. > I believe directing the attack to VLAN1 should just kill the remote > management and won't effect switching capability. Can anyone confirm? Ah, you are right. I just tested it, and the switching through the catalyst continues without interruption. Only the management interface is unavailable. --steve

1 0

RE: Cisco vulnerability on smaller catalyst switches
by Steve Rude 18 Jul '03

18 Jul '03

> As part of our vulnerability tests, we have been unable to confirm that > the smaller catalyst switches running IOS but without L3 capability are > vulnerable. They don't seem to react in a negative way to the same > attacks that lock up the other devices we have tested. Has anyone else > been able to verify this one way or the other? I tested Catalyst 2924-XL-EN with 12.0(5)WC5a and I found that without L3 capability it does not seem to be affected. But with L3 connectivity, if you direct the attack at the VLAN1 interface it is definitely susceptible. I've tested 12.0(5)WC8 and it has the fix. --steve

2 1

RE: Cisco vulnerability on smaller catalyst switches
by McBurnett, Jim 18 Jul '03

18 Jul '03

With the idea below. What is the current opinion about upgraded switches behind a firewall on a private lan? I suspect upgrade later or not at all. But curious about other's opinions.. Later, J -----Original Message----- From: Chris Griffin [mailto:cgriffin@ufl.edu] Sent: Friday, July 18, 2003 5:58 PM To: nanog(a)merit.edu Subject: Cisco vulnerability on smaller catalyst switches As part of our vulnerability tests, we have been unable to confirm that the smaller catalyst switches running IOS but without L3 capability are vulnerable. They don't seem to react in a negative way to the same attacks that lock up the other devices we have tested. Has anyone else been able to verify this one way or the other? -- Chris Griffin cgriffin(a)ufl.edu Network Engineer - CCNP Phone: (352) 392-2061 OIT - Network Services Fax: (352) 392-9440 University of Florida Gainesville, FL 32611

1 0

Re: [Patching for Cisco vulnerability]
by Joshua Sahala 18 Jul '03

18 Jul '03

"Irwin Lazar" <ILazar(a)burtongroup.com> wrote: > > Just out of curiosity, are folks just applying the Cisco patch or do you go > through some sort of testing/validation process to ensure that the patch > doesn't cause any other problems? Given typical change management > procedures how long is taking you to get clearance to apply the patch? > > I'm trying here to gauge the length of time before this vulnerability is closed out. > > irwin > it will be 'closed' probably about the same time that code red goes away....there will be routers sitting somewhere that are not upgraded (whether due to insufficient hardware or skill or because they are in storage). yes the publicity will help, but there is/was a lot of publicity other exploits/holes, and they are still there. /joshua "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0

RE: Patching for Cisco vulnerability
by Dan Lockwood 18 Jul '03

18 Jul '03

What kind of testing protocol do providers have in place to test IOS images prior to deployment. I have never been exposed to those processes and am curious to understand what takes place as a BCP. Dan -----Original Message----- From: Jared Mauch [mailto:jared@puck.Nether.net] Sent: Friday, July 18, 2003 12:05 To: Irwin Lazar Cc: nanog(a)merit.edu Subject: Re: Patching for Cisco vulnerability On Fri, Jul 18, 2003 at 12:29:30PM -0600, Irwin Lazar wrote: > > Just out of curiosity, are folks just applying the Cisco patch or do > you go through some sort of testing/validation process to ensure that > the patch doesn't cause any other problems? Given typical change > management procedures how long is taking you to get clearance to apply > the patch? > > I'm trying here to gauge the length of time before this vulnerability > is closed out. most providers can easily go from (for example) 12.0(21)S3 to 12.0(21)S7 with less testing than from 12.0(21)S to 12.0(25)S The hurdles are still there to maintain the necessary customer notifications, etc.. but aside from that, I think the press is doing their job (good or bad) in that most customers are aware that there's something bad going on and people are moving to protect the internet infrastructure. - jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0

BGP flap dampening considered harmful
by Sean Donelan 18 Jul '03

18 Jul '03

Providers which aggressively flap dampen routes may want to consider periodically clearing their dampened routes over the next few days. A lot of providers are changing routes, and sometimes its the intermediate providers reloading their routers causing the flaps. It seems some people dampen some routes for hours after they've been restored.

1 0

after Cisco IOS exploit patch
by Saxon Jones 18 Jul '03

18 Jul '03

After I upgraded my IOS this morning I've seen 13,844 input errors on the port; when looking at the switch the router is connected to I see that a very similar number of multi-cast packets (13,423). Has anyone else seen this? Is this perhaps what the patch does (register exploit packets as input errors)? FastEthernet0/0 is up, line protocol is up Hardware is DEC21140A, address is 0002.1723.0800 (bia 0002.1723.0800) Internet address is 199.185.131.249/24 MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 106/255, rxload 118/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, 100BaseTX/FX ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters never Input queue: 0/75/53/231 (size/max/drops/flushes); Total output drops: 733 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 46298000 bits/sec, 9642 packets/sec 5 minute output rate 41710000 bits/sec, 8891 packets/sec 163709405 packets input, 2006456215 bytes Received 11374 broadcasts, 0 runts, 0 giants, 2 throttles 13844 input errors, 0 CRC, 0 frame, 0 overrun, 13182 ignored 0 watchdog 0 input packets with dribble condition detected 157777703 packets output, 1121349334 bytes, 0 underruns 0 output errors, 0 collisions, 2 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out FastEthernet8 is up Hardware is FastEthernet, address is 00e0.5202.4613 (bia 00e0.5202.4613) Configured speed 100Mbit, actual 100Mbit, configured duplex fdx, actual fdx Member of L2 VLAN ID 1, port is untagged, port state is FORWARDING STP configured to OFF, priority is high, flow control enabled mirror disabled, monitor disabled Not member of any active trunks Not member of any configured trunks No port name 5 minute input rate: 43045336 bits/sec, 8985 packets/sec, 44.47% utilization 5 minute output rate: 46621104 bits/sec, 9711 packets/sec, 48.16% utilization 689714869 packets input, 3817420687 bytes, 0 no buffer Received 4493 broadcasts, 0 runts, 0 giants 5 input errors, 5 CRC, 0 frame, 0 ignored 13423 multicast 736196013 packets output, 1836390208 bytes, 0 underruns 0 output errors, 0 collisions ________________________ saxon jones network infrastructure admin interbaun communications suite 200 18404 stony plain road edmonton, ab T5S 2M8 <mailto:netadmin@interbaun.net> mailto:netadmin@interbaun.net <http://www.interbaun.com/> http://www.interbaun.com/ (780) 447-8276

2 1

Cisco DoS exploits in the wild?
by Scott Waddell 18 Jul '03

18 Jul '03

Hi all, Is anyone seeing active exploits of the latest Cisco DoS now that exploit code is public? The following article claims that attacks have been reported: http://biz.yahoo.com/djus/030718/1136000519_2.html Thanks, Scott __ Scott Waddell Global Defense & Space Group Cisco Systems, Inc. swaddell(a)cisco.com

2 1

RE: Cisco exploit and Huawei
by Martin, Christian 18 Jul '03

18 Jul '03

Now that would be quite telling - and may put the nail in the antitrust coffin! Chris >-----Original Message----- >From: Rubens Kuhl Jr. [mailto:rubens@email.com] >Sent: Friday, July 18, 2003 10:44 AM >To: nanog(a)merit.edu >Subject: Cisco exploit and Huawei > > > > >It would be interesting to know if Huawei routers also falls >to the Cisco IOS exploit... > > >Rubens > >

1 0

Re: Cisco exploit and Huawei
by Rubens Kuhl Jr. 18 Jul '03

18 Jul '03

As listed on the advisory, e-maiing tac(a)cisco.com. A "show tech" and the chassis S/N on the front mail will help expedite the process... Rubens ----- Original Message ----- From: "Vincent Poy" <vince(a)oahu.WURLDLINK.NET> To: "Rubens Kuhl Jr." <rubens(a)email.com> Cc: <nanog(a)merit.edu> Sent: Friday, July 18, 2003 12:01 PM Subject: Re: Cisco exploit and Huawei | Speaking about the patches, how does one get the patches if they | don't have a support contract with Cisco? | | | Cheers, | Vince - vince(a)WURLDLINK.NET - Vice President ________ __ ____ | Unix Networking Operations - FreeBSD-Real Unix for Free / / / / | / [__ ] | WurldLink Corporation / / / / | / | __] ] | San Francisco - Honolulu - Hong Kong / / / / / |/ / | __] ] | HongKong Stars/Gravis UltraSound Mailing Lists Admin /_/_/_/_/|___/|_|[____] | Almighty1@IRC - oahu.DAL.NET Hawaii's DALnet IRC Network Server Admin |

1 0