August 2004 - Test - lists.nanog.org

RE: Blocked port 25?
by Michel Py 19 Aug '04

19 Aug '04

Looks like your personal email has issues too... > Your message did not reach some or all of the intended > recipients. Subject: RE: Blocked port 25? Sent: > 8/19/2004 6:49 AM The following recipient(s) could not > be reached: 'byronhicks(a)byronhicks.com' on 8/19/2004 > 6:49 AM The destination server for this recipient could > not be found in Domain Name Service (DNS). >nslookup >Default Server: localhost >Address: 127.0.0.1 >set type=ns >byronhicks.com >Server: localhost >Address: 127.0.0.1 >*** localhost can't find byronhicks.com: Non-existent domain Is your mail server 128.123.3.5? Looks like I can't get to it from home; I'm on one of these netblocks that are marked as dynamic IPs although it also serves static IP addresses such as myself. I can send UDP DNS queries and get replies to/from it just fine though, so it's likely not a routing issue but indeed a filtering issue. Conventional wisdom says that the problem is either at your end or somewhere in Time Warner, and possibly because your mail server is also a DNS server. Setup a machine that listens on 25 on another IP on the same subnet, and let me know the IP, I'll give it another shot. Michel. Tracing route to dns1.NMSU.Edu [128.123.3.5] over a maximum of 30 hops: 3 9 ms 8 ms 9 ms dist1-vlan60.scrm01.pbi.net [64.171.152.130] 4 9 ms 8 ms 9 ms bb1-g8-3-0.scrm01.pbi.net [64.171.152.247] 5 13 ms 13 ms 13 ms bb1-p12-3.sntc01.sbcglobal.net [151.164.188.121] 6 12 ms 13 ms 13 ms bb2-p9-0.sntc01.sbcglobal.net [151.164.40.166] 7 13 ms 13 ms 13 ms core2-p6-1.crscca.sbcglobal.net [151.164.241.193] 8 13 ms 13 ms 13 ms bb1-p8-0.crscca.sbcglobal.net [151.164.40.62] 9 14 ms 14 ms 14 ms ex1-p13-0.pxpaca.sbcglobal.net [151.164.190.206] 10 13 ms 13 ms 14 ms as4323-twtelecom.pxpaca.sbcglobal.net [151.164.248.110] 11 15 ms 15 ms 16 ms 66.192.250.45 12 62 ms 62 ms 61 ms core-01-so-0-0-0-0.phnx.twtelecom.net [168.215.55.114] 13 72 ms 72 ms 73 ms dist-01-so-2-3-0-0.albq.twtelecom.net [66.192.251.243] 14 72 ms 72 ms 73 ms 66.192.247.133 15 * * * Request timed out. 16 * * * Request timed out. 17 * * * Request timed out.

1 0

FW: hey had eric sent you
by Riley, Marty 19 Aug '04

19 Aug '04

I'm running short on theories and options, so I thought I would see if any other ISPs have seen this problem on your network(s). If so, what was the cure? mjr -----Original Message----- The Unknown problem. Symptoms: At random times dialup, dedicated, & internal network users are unable to pass TCP traffic to off network sites. ICMP and UDP appears to be uneffected by the outage which lasts anywhere from 2 to 5 minutes. The problem appears to be wide spread with similar reports from WVNET and other ISPS. nTelos is experiencing a similar problem but we have yet to confirm it is the same. Problem has changed in it's action but remained similar enough to consider it the same problem. Effected Platforms: Windows 2000 Pro, XP Home, XP Pro, & 2003 Server. Uneffected Platforms: Unix, MacOS (?) History: During the week of 2/9/04 the call center started recieving reports of users being unable to connect to sites off the CityNet network. Sites hosted on the internal network are uneffected by the outage. Initally it was thought to be a Internet Explorer problem possably caused by the KB832894 / IE SP1 or other updates but after further investigation it was found that Mozilla users were encountering the same problem. After several days of testing it was determined that during the outage any TCP session started on any port would fail. TCP sessions started before the outage continue to work and show no ill effects from the outage. After logging connection attempts at various intervals on many machines there appears to be no sort of pattern in the outages. Most machines encounter the problem, some more than others and a few do not encounter it at all. The duration and frequency of the outage is very fluid. During an outage, we can verify that the packet does seem to leave and reenter the network: Mar 5 22:28:04 pittpa-chaswv-ds3 17083: SLOT 2:6d20h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.14.174(3376) -> 216.41.224.3(80), 1 packet Mar 5 22:28:09 pittpa-chaswv-ds3 17084: SLOT 1:6d20h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.14.174(3376), 1 packet Mar 5 22:28:09 pittpa-chaswv-ds3 17085: SLOT 2:6d20h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.14.174(3378) -> 216.41.224.3(80), 1 packet Mar 5 22:28:09 pittpa-chaswv-ds3 17086: SLOT 1:6d20h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.14.174(3378), 1 packet Mar 5 22:33:24 pittpa-chaswv-ds3 17089: SLOT 1:6d20h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.14.174(3378), 7 packets Mar 5 22:33:24 pittpa-chaswv-ds3 17090: SLOT 1:6d20h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.14.174(3376), 17 packets Mar 5 22:33:58 pittpa-chaswv-ds3 17092: SLOT 2:6d20h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.14.174(3378) -> 216.41.224.3(80), 7 packets Mar 5 22:33:58 pittpa-chaswv-ds3 17093: SLOT 2:6d20h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.14.174(3376) -> 216.41.224.3(80), 18 packets Mar 5 00:58:30 pittpa-clarwv-ds3 16062: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3183) -> 216.41.224.3(80), 1 packet Mar 5 00:58:30 pittpa-clarwv-ds3 16063: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3183), 1 packet Mar 5 01:03:28 pittpa-clarwv-ds3 16067: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3217) -> 216.41.224.3(80), 1 packet Mar 5 01:03:28 pittpa-clarwv-ds3 16068: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3217), 1 packet Mar 5 01:03:34 pittpa-clarwv-ds3 16069: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3228) -> 216.41.224.3(80), 1 packet Mar 5 01:03:34 pittpa-clarwv-ds3 16070: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3228), 1 packet Mar 5 01:03:39 pittpa-clarwv-ds3 16072: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3239) -> 216.41.224.3(80), 1 packet Mar 5 01:03:47 pittpa-clarwv-ds3 16073: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3183) -> 216.41.224.3(80), 74 packets Mar 5 01:04:13 pittpa-clarwv-ds3 16075: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3183), 72 packets Mar 5 01:08:46 pittpa-clarwv-ds3 16078: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3218) -> 216.41.224.3(80), 4 packets Mar 5 01:08:46 pittpa-clarwv-ds3 16079: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3217) -> 216.41.224.3(80), 3 packets Mar 5 01:08:46 pittpa-clarwv-ds3 16080: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3221) -> 216.41.224.3(80), 19 packets Mar 5 01:08:46 pittpa-clarwv-ds3 16081: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3228) -> 216.41.224.3(80), 5 packets Mar 5 01:08:46 pittpa-clarwv-ds3 16082: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3229) -> 216.41.224.3(80), 6 packets Mar 5 01:08:46 pittpa-clarwv-ds3 16083: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3236) -> 216.41.224.3(80), 9 packets Mar 5 01:08:47 pittpa-clarwv-ds3 16084: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3233) -> 216.41.224.3(80), 12 packets Mar 5 01:08:47 pittpa-clarwv-ds3 16085: SLOT 2:5d22h: %SEC-6-IPACCESSLOGP: list 113 permitted tcp 69.43.23.23(3239) -> 216.41.224.3(80), 21 packets Mar 5 01:09:12 pittpa-clarwv-ds3 16087: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3239), 19 packets Mar 5 01:09:12 pittpa-clarwv-ds3 16088: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3228), 4 packets Mar 5 01:09:12 pittpa-clarwv-ds3 16089: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3217), 2 packets Mar 5 01:09:12 pittpa-clarwv-ds3 16091: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3218), 3 packets Mar 5 01:09:13 pittpa-clarwv-ds3 16092: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3221), 17 packets Mar 5 01:09:13 pittpa-clarwv-ds3 16093: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3229), 5 packets Mar 5 01:09:13 pittpa-clarwv-ds3 16094: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3236), 7 packets Mar 5 01:09:13 pittpa-clarwv-ds3 16096: SLOT 1:5d22h: %SEC-6-IPACCESSLOGP: list 111 permitted tcp 216.41.224.3(80) -> 69.43.23.23(3233), 9 packets Network analysis showed significant amounts of spoofed multicast traffic and odd arp traffic. 10:17:16.416222 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 278 10:17:16.421886 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 334 10:17:16.423873 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 262 10:17:16.426948 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 254 10:17:16.432095 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 298 10:17:16.435921 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 274 10:17:16.439959 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 328 10:17:16.445317 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 326 10:17:16.449688 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 330 10:17:16.463537 IP 192.168.1.1.1900 > 239.255.255.250.1900: udp 322 Steps were taken to elminiate the spoofed traffic on the routers and access servers in the form of ACLs and filter lists. Neither have eliminiated the problem... but to what extent they might have helped has yet to be determined. The problem is still occuring, for some users the duration of the outage seems to have shortened other users notice no difference. It is not yet known if the filtering on the routers and access servers or the conversion to the 10.x.x.x network has made any difference. We should have a better idea in the upcoming days. What Doesn't help: Removing windows updates. Turning off XP firewall. Searching for malware. (SpyBot-SD, Adaware) Virus scanning (Various softwares) Specifying dns servers. Reinstalling windows.

7 6

RE: Specialty Technical Publishers
by Michel Py 19 Aug '04

19 Aug '04

>> Michel Py wrote: >> File a complaint with the BBB of Vancouver, BC. They are known >> to the BBB. Then, let their collection goons waste their time >> and their money, and tell them that if they want to see it back >> they have to send you a prepaid box. > Mike Lewinski wrote: > Ah, excellent pointer! I see the Vancouver BBB lists this > report on their website also indicating a pattern of abuse: > http://166.70.33.197/~van/commonreport.html?bid=105759 Yeah, that's the kind of customer that has a valid address on each side of the US/Canada border, and I'm happy to have their Internet service provided by a competitor. Sooner or later, someone is going to get pissed and let some steam out with one of these $65 DDOS that Alexei mentioned sometime ago. Michel.

1 0

RE: Specialty Technical Publishers
by Michel Py 18 Aug '04

18 Aug '04

> Mike Lewinski wrote: > Has anyone else has run into these scumbags? Sometime last > winter I received a call along the lines of "We'd like to > send you some materials to review". Well, they sent some > "Internet Law encyclopedia" along with an invoice for ~$700. > Of course, there was no cost mentioned in the sales call- > for all I knew they were going to send me a brochure about > their product. I can say with 100% certainty that I would > never have authorized them to send me something like this > had they mentioned the cost without much further discussion > as to what I was receiving. This is just a general heads-up > to a sleazy business practice for a sleazy company that is > now attempting to extort money. File a complaint with the BBB of Vancouver, BC. They are known to the BBB. Then, let their collection goons waste their time and their money, and tell them that if they want to see it back they have to send you a prepaid box. Michel.

2 1

Domain Name System protection
by Joe Shen 18 Aug '04

18 Aug '04

Hi, We are trying to extend our DNS service system in near future. In current stage, it consist of 2 SUN FIRE Server with Solaris8 and BIND9 installed. Each server is configured with a IP address which is known to our customers. The DNS server is set up as Cache Server because it only servers our customers to lookup domain names. We noticed there is continous name resolution requests from IP address outside of our address pool and also there is requests not conforming to DNS documents ( like those from 10/8, 192.168/16 or something for microsoft proxy server name). We think these request waste our resource and we don't want these system stable, secure and high performance. The amount of DNS requests processed in past week is about 0.8Billion. What I'm not sure with designing new Cache Server farm is : 1. Is that really required to protect DNS server by firewall? How does those ISPs, e.g. AT&T, Sprint,mae their DNS system highly available? Could we do that by filtering traffic besides port destinated to port 53? 2. How could we extend our server farm by adding new servers while announcing the same IP addresses to our customers? 3. Is there any evaluation result of DNS server software? e.g. performance, resource required, stability, security etc.? 4. Which hardware/OS platform is better for DNS service? 5. Is that possible to filter those requests not conforming to DNS documents? Each word will be highly appreciated! Joe __________________________________________________ Do You Yahoo!? Download the latest ringtones, games, and more! http://sg.mobile.yahoo.com

13 22

WashingtonPost computer security stories
by Sean Donelan 18 Aug '04

18 Aug '04

The Washington Post is running a group of stories this weekend about computer security and the problems a reporter went through with her Windows 98 computer. Interestingly, instead of ISPs the articles identify other sources of frustration for even technically savvy home computer user with software vendors and overzealous advertisers. A Digital Doctor Treats Computer Contamination http://www.washingtonpost.com/wp-dyn/articles/A64481-2004Aug14.html By Glenn Paterson Special to The Washington Post Sunday, August 15, 2004; Page F01 [...] Her PC was in such bad shape, it required 10 1/2 hours of surgery to restore it to working condition. [...] Finally, I abandoned ship, reinstalling the entire Windows 98 operating system to repair the damage to Internet Explorer and allow Kathleen's computer to access the Internet and update the Norton AntiVirus definitions. [...] So to sum up, I spent one day cleaning up problems created by ne'er-do-well hackers and overzealous advertisers and four more trying to resolve a known problem with a product that is supposed to help prevent problems, not create new ones. Yes, some of the trouble could have been avoided if Kathleen had kept her anti-virus and operating system software up to date. However, much of the responsibility lies with Symantec and the rest of the computer industry. [...] What a Tangled Web I Wove Computer Naivete Cost Me a Bundle And a Bit of Sanity http://www.washingtonpost.com/wp-dyn/articles/A64483-2004Aug14.html By Kathleen Day Washington Post Staff Writer Sunday, August 15, 2004; Page F01 My problem began the last Sunday in July, when my nearly teenage daughter, newly returned from a month away at camp, announced, "Something's wrong with the computer." [...] In fact, her comment marked the start of a much larger headache, one that launched an odyssey that has taken $800 and roughly 48 man-hours over nearly three weeks to end. [...] I wondered if maybe some of the programs I was trying to kill weren't really spyware but something essential to Windows that I shouldn't try to delete. I called Microsoft and was passed from operator to operator as I asked where I could find a list of legitimate Microsoft applications so I would know what to kill and what to leave alone. But the only response I got from one person after another -- most of them in foreign tech-support centers like those in India I had been reading so much about lately -- was that I needed to go to Microsoft's online sales. After 45 minutes of this, I hung up. Then I gave up. I actually stood up and walked away from my computer. [...]

23 28

RE: Current street prices for US Internet Transit
by William B. Norton 18 Aug '04

18 Aug '04

Thanks to all who replied with data, and yes, the pricing was all 95th percentile. Wow - the U.S. has an amazingly unhealthy and cut throat transit market in 2004. About 20 folks responded, most saying the Peering Coordinator quotes (below) sounded about right. > > ISP Transit Commits and Prices > >--------------------------------------------------------------------------------------------------------------------- > > if you commit to 1M per month you will pay about $125/Mbps > > if you commit to 10M per month you will pay about $ 60/Mbps > > if you commit to 100M per month you will pay about $45/Mbps > > if you commit to 1000M per month you will pay about $30/Mbps A couple people said these prices were TOO HIGH, particularly for the gig commit, although several multi-gig commits came in tiered; for example, $45/Mbps for 1G commit, $35 for 2G, etc. on down to $21 for 8G commit. (One Tier 2 ISP said that they sold 1G commit as low as $18/Mbps, presumably simply reselling Tier 1 BW so the difference may be negligible.) Three said that these transit prices were TOO LOW, in one case they paid about double these numbers. It was interesting that these three were a content company, a cable company and a DSL company, folks who traditionally don't sell transit. Maybe they are in a retail market for transit, while everyone else buys in the wholesale market. Since so many said these prices are about right, I'll use them for the Peering versus Transit analysis. A couple people pointed to the 10M commit being closer to $80/Mbps, so that may be an adjustment. Given the adjustment, I thought you might be interested in how the U.S. transit prices compare against a handful of other Peering Ecosystems: The Cost of Internet Transit in Commit AU SG JP HK USA 1 Mbps $720 $625 $490 $185 $125 10 Mbps $410 $350 $150 $100 $80 100 Mbps $325 $210 $110 $80 $45 1000 Mbps $305 $115 $50 $50 $30 Round numbers anyway FWIW. Hope this helps. I feel bad for those selling transit these days - at these prices, margins must be mighty thin, and I suspect we will see some more turbulence in the industry. Bill

19 35

Re: SYN flood atacks?
by jgraun＠comcast.net 18 Aug '04

18 Aug '04

Sorry I didnt take the smart ass factor into account when I posted. I have heard that AOL and other mega proxies have been sending enough SYN floods (DDoS style) to knock over Discover and Allstate. I am not talking about small amounts of normal traffic. Jason -------------- Original message -------------- > > > On Tue, 17 Aug 2004 jgraun(a)comcast.net wrote: > > I have been hearing rumors about some SYN flood atacks on the Internet > > today. Anybody hear anything? > > You will need to be more specific. > > There are syn flood attacks, icmp attacks, udp attacks, tcp attacks, dns > attacks, http attacks, im attacks, ipsec attacks, etc going on every day, > all day. > >

3 2

Cisco Security Advisory: Cisco IOS Malformed OSPF Packet Causes Reload
by Cisco Systems Product Security Incident Response Team 18 Aug '04

18 Aug '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco IOS Malformed OSPF Packet Causes Reload Revision 1.0 For Public Release 2004 August 18 15:00 UTC (GMT) - ---------------------------------------------------------------------------- Contents Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice: FINAL Distribution Revision History Cisco Security Procedures - ---------------------------------------------------------------------------- Summary ======= A Cisco device running Internetwork Operating System (IOS) and enabled for the Open Shortest Path First (OSPF) protocol is vulnerable to a Denial of Service (DoS) attack from a malformed OSPF packet. The OSPF protocol is not enabled by default. The vulnerability is only present in Cisco IOS release trains based on 12.0S, 12.2, and 12.3. Releases based on 12.0, 12.1 mainlines, and all Cisco IOS images prior to 12.0 are not affected. Cisco has made free software available to address this vulnerability. There are workarounds available to mitigate the effects. This advisory is available at http://www.cisco.com/warp/public/707/cisco-sa-20040818-ospf.shtml. Affected Products ================= Vulnerable Products This vulnerability was introduced by a code change that was committed to the 12.0S, 12.2, and 12.3 based release trains, causing these trains to be vulnerable. All Cisco devices running a vulnerable release train and running OSPF process are vulnerable. Some release trains that are not vulnerable are explicitly listed below for clarification. The release trains that are not mentioned below are not vulnerable. +---------------------------------------------+ | Release Train | Vulnerable | | | Versions | |-------------------------------+-------------| | 10.x based releases | Not | | | vulnerable | |-------------------------------+-------------| | 11.x based releases | Not | | | vulnerable | |-------------------------------+-------------| | 12.0 based releases (except | Not | | for 12.0.S based releases) | vulnerable | |-------------------------------+-------------| | 12.1 based releases | Not | | | vulnerable | |-------------------------------+-------------| | 12.0.S | 12.0(22)S | | | and later | |-------------------------------+-------------| | 12.0.SX | 12.0(23)SX | | | and later | |-------------------------------+-------------| | 12.0.SY | 12.0(22)SY | | | and later | |-------------------------------+-------------| | 12.0.SZ | 12.0(23)SZ | | | and later | |-------------------------------+-------------| | 12.2 mainline | Not | | | vulnerable | |-------------------------------+-------------| | 12.2.B | 12.2(15)B | | | and later | |-------------------------------+-------------| | 12.2.BC | 12.2(15)BC | | | and later | |-------------------------------+-------------| | 12.2.BX | 12.2(15)BX | | | and later | |-------------------------------+-------------| | 12.2.BZ | 12.2(15)BZ | | | and later | |-------------------------------+-------------| | 12.2.CX | 12.2(15)CX | | | and later | |-------------------------------+-------------| | 12.2.EW | 12.2(18)EW | | | and later | |-------------------------------+-------------| | 12.2.MC | 12.2(15)MC1 | | | and later | |-------------------------------+-------------| | 12.2.S | 12.2(18)S | | | and later | |-------------------------------+-------------| | 12.2.SE | 12.2(18)SE | | | and later | |-------------------------------+-------------| | 12.2.SV | 12.2(18)SV | | | and later | |-------------------------------+-------------| | 12.2.SW | 12.2(18)SW | | | and later | |-------------------------------+-------------| | 12.2.SZ | 12.2(14)SZ | | | and later | |-------------------------------+-------------| | 12.2.T | 12.2(15)T | | | and later | |-------------------------------+-------------| | 12.2.YU | 12.2(11)YU | | | and later | |-------------------------------+-------------| | 12.2.YV | 12.2(11)YV | | | and later | |-------------------------------+-------------| | 12.2.ZD | 12.2(13)ZD | | | and later | |-------------------------------+-------------| | 12.2.ZE | 12.2(13)ZE | | | and later | |-------------------------------+-------------| | 12.2.ZF | 12.2(13)ZF | | | and later | |-------------------------------+-------------| | 12.2.ZG | 12.2(13)ZG | | | and later | |-------------------------------+-------------| | 12.2.ZH | 12.2(13)ZH | | | and later | |-------------------------------+-------------| | 12.2.ZJ | 12.2(15)ZJ | | | and later | |-------------------------------+-------------| | 12.2.ZK | 12.2(15)ZK | | | and later | |-------------------------------+-------------| | 12.2.ZL | 12.2(15)ZL | | | and later | |-------------------------------+-------------| | 12.2.ZN | 12.2(15)ZN | | | and later | |-------------------------------+-------------| | 12.2.ZO | 12.2(15)ZO | | | and later | |-------------------------------+-------------| | 12.3 | All 12.3 | | | releases | |-------------------------------+-------------| | 12.3.B | All 12.3.B | | | releases | |-------------------------------+-------------| | 12.3.BW | All 12.3.BW | | | releases | |-------------------------------+-------------| | 12.3.T | All 12.3.T | | | releases | |-------------------------------+-------------| | 12.3.XA | All 12.3.XA | | | releases | |-------------------------------+-------------| | 12.3.XB | All 12.3.XB | | | releases | |-------------------------------+-------------| | 12.3.XC | All 12.3.XC | | | releases | |-------------------------------+-------------| | 12.3.XE | All 12.3.XE | | | releases | +---------------------------------------------+ A Cisco device which is running an OSPF process will have a line in the configuration defining the process number, which can be seen by issuing the command show running-config: router ospf {process number} To determine the software running on a Cisco product, log in to the device and issue the show version command to display the system banner. Cisco IOS software will identify itself as "Internetwork Operating System Software" or simply "IOS." On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the Cisco IOS release name. Other Cisco devices will not have the show version command, or will give different output. The following example identifies a Cisco product running Cisco IOS release 12.0 (3) with an installed image name of C2500-IS-L: Cisco Internetwork Operating System Software IOS (TM) 2500 Software (C2500-IS-L), Version 12.0(3), RELEASE SOFTWARE The release train label is "12.0." The next example shows a product running Cisco IOS release 12.0(2a)T1 with an image name of C2600-JS-MZ: Cisco Internetwork Operating System Software IOS (tm) C2600 Software (C2600-JS-MZ), Version 12.0(2a)T1, RELEASE SOFTWARE (fc1) Additional information about Cisco IOS release naming can be found at http://www.cisco.com/warp/public/620/1.html. Products Confirmed Not Vulnerable * Products that are not running Cisco IOS are not affected. * Products running Cisco IOS versions 12.0 and earlier (excluding 12.0 S), 12.1 mainline and 12.2 mainline are not vulnerable. * Products running IOS release trains that are not mentioned in the above table are not vulnerable. * Products running any version of Cisco IOS that do not have OSPF configured are not vulnerable. Details ======= OSPF is a routing protocol defined by RFC 2328. It is designed to manage IP routing inside an Autonomous System (AS). OSPF packets use IP protocol number 89. A vulnerability exists in the processing of an OSPF packet that can be exploited to cause the reload of a system. Several parameters need to be known by an attacker to successfully exploit this vulnerability. These are the OSPF area number, netmask, hello, and dead timers that are configured on the targeted interface. Since OSPF needs to process unicast packets as well as multicast packets, this vulnerability can be exploited remotely. It is also possible for an attacker to target multiple systems on the local segment at a time. Using OSPF Authentication as described in the workarounds section can be used to mitigate the effects of this vulnerability. Using OSPF Authentication is a highly recommended security best practice A Cisco device receiving a malformed OSPF packet will reset and may take several minutes to become fully functional. This vulnerability may be exploited repeatedly resulting in an extended DOS attack. This issue is documented in bug ID CSCec16481. Impact ====== Successful exploitation of this vulnerability results in a reload of the device. Repeated exploitation could result in a sustained DoS attack. Software Versions and Fixes =========================== +--------------------------------------------------+ | Major | Availability of Repaired Releases* | | Release | | |------------+-------------------------------------| | Affected | | | | | 12.0-Based | Rebuild | Interim** | Maintenance | | Release | | | | |------------+-----------+-----------+-------------| | | 12.0(22) | | | | |S6 | |-------------| | | | | | | |-----------| |-------------| | | 12.0(23) | | | | | S5 | | | | |-----------+-----------+-------------| | | 12.0(24) | | | | | S2c | | | | |-----------+-----------+-------------| | 12.0(22)S | 12.0(24) | | | | and later | S4 | | | | |-----------+-----------+-------------| | | 12.0(25) | | | | | S1d | | | | |-----------+-----------+-------------| | | 12.0(25) | | | | | S2 | | | | |-----------+-----------+-------------| | | 12.0(26) | | | | |S1 |-----------|12.0(27)S | | | | | | |------------+-----------+-----------+-------------| | 12.0(23)SX | 12.0(25) | | | | and later | SX2 | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.0(22)SY | to 12.0 | | | | and later | (23)S5 or | | | | | later | | | |------------+-----------+-----------+-------------| | 12.0(23)SZ | | | 12.0(27)SZ | | and later | | | | |------------+-----------+-----------+-------------| | Affected | | | | | 12.2-Based | Rebuild | Interim** | Maintenance | | Release | | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(15)B | to 12.3 | | | | and later | (4)T or | | | | | later | | | |------------+-----------+-----------+-------------| | | 12.2(15) | | | | 12.2(15)BC | BC1c | | | |and later |-----------| | | | | 12.2(15) | | | | | BC2 | | | |------------+-----------+-----------+-------------| | | 12.2(16) | | | | | BX | | | | 12.2(15)BX | Migrate | | | | and later | to 12.3 | | | | | (7)XI1 or | | | | | later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(15)BZ | to 12.3 | | | | and later | (7)XI1 or | | | | | later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(15)CX | to 12.2 | | | | and later | (15)BC2 | | | | | or later | | | |------------+-----------+-----------+-------------| | 12.2(18)EW | 12.2(18) | | | | | EW1 | | | |------------+-----------+-----------+-------------| | | 12.2(15) | | | | 12.2(15) | MC2a | | | | MC1 and | available | | | | later | upon | | | | | request | | | |------------+-----------+-----------+-------------| | 12.2(18)S | 12.2(18) | | 12.2(20)S | | and later | S5 | | | |------------+-----------+-----------+-------------| | 12.2(18)SE | | | 12.2(20)SE | | and later | | | | |------------+-----------+-----------+-------------| | 12.2(18)SV | | | 12.2(22)SV | | and later | | | | |------------+-----------+-----------+-------------| | 12.2(18)SW | | | 12.2(20)SW | | and later | | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(14)SZ | to 12.2 | | | | and later | (20)S4 or | | | | | later | | | |------------+-----------+-----------+-------------| | 12.2(15)T | 12.2(15) | | | | and later | T8 | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(11)YU | to 12.3 | | | | and later | (4)T or | | | | | later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(11)YV | to 12.3 | | | | and later | (4)T or | | | | | later | | | |------------+-----------+-----------+-------------| | 12.2(13)ZD | Migrate | | | | and later | to 12.3T | | | | | or later | | | |------------+-----------+-----------+-------------| | 12.2(13)ZE | Migrate | | | | and later | to 12.3 | | | | | or later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(13)ZF | to 12.3 | | | | and later | (4)T or | | | | | later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(13)ZG | to 12.3 | | | | and later | (4)T or | | | | | later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(13)ZH | to 12.3 | | | | and later | (4)T or | | | | | later | | | |------------+-----------+-----------+-------------| | 12.2(15)ZJ | Migrate | | | | and later | to 12.3T | | | | | or later | | | |------------+-----------+-----------+-------------| | 12.2(15)ZK | 12.2(15) | | | | and later | ZK2 | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(15)ZL | to 12.3 | | | | and later | (7)T or | | | | | later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(15)ZN | to 12.3 | | | | and later | (2)T4 or | | | | | later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.2(15)ZO | to 12.2 | | | | and later | (15)T8 or | | | | | later | | | |------------+-----------+-----------+-------------| | Affected | | | | | 12.3-Based | Rebuild | Interim** | Maintenance | | Release | | | | |------------+-----------+-----------+-------------| | 12.3 | 12.3(3f) | | 12.3(5) | |------------+-----------+-----------+-------------| | 12.3B | 12.3(5a)B | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.3BW | to 12.3B | | | | | or later | | | |------------+-----------+-----------+-------------| | 12.3T | 12.3(2)T4 | | 12.3(4)T | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.3XA | to 12.3 | | | | | (7)T or | | | | | later | | | |------------+-----------+-----------+-------------| | 12.3XB | 12.3(2) | | | | | XB3 | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.3XC | to 12.3 | | | | | (8)T or | | | | | later | | | |------------+-----------+-----------+-------------| | | Migrate | | | | 12.3XE | to 12.3 | | | | | (8)T or | | | | | later | | | +--------------------------------------------------+ Obtaining Fixed Software ======================== Customers with Service Contracts Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third-party Support Organizations Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with the upgrade, which should be free of charge. Customers without Service Contracts Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Please have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Please do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades. Workarounds =========== The effectiveness of any workaround is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround is the most appropriate for use in the intended network before it is deployed. There are multiple workarounds available to mitigate the effects of this vulnerability. Using OSPF Authentication OSPF authentication may be used as a workaround. OSPF packets without a valid key will not be processed. MD5 authentication is highly recommended, due to inherent weaknesses in plain text authentication. With plain text authentication, the authentication key will be sent unencrypted over the network, which can allow an attacker on a local network segment to capture the key by sniffing packets. Refer to http://www.cisco.com/warp/public/104/25.shtml for more information about OSPF authentication. Infrastructure Access Control Lists Although it is often difficult to block traffic transiting your network, it is possible to identify traffic which should never be allowed to target your infrastructure devices and block that traffic at the border of your network. Infrastructure ACLs are considered a network security best practice and should be considered as a long-term addition to good network security as well as a workaround for this specific vulnerability. The white paper "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection ACLs: http://www.cisco.com/warp/public/707/iacl.html. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. Status of This Notice: FINAL ============================ THIS ADVISORY IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. YOUR USE OF THE INFORMATION ON THE ADVISORY OR MATERIALS LINKED FROM THE ADVISORY IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS NOTICE AT ANY TIME. Distribution ============ This advisory will be posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20040818-ospf.shtml. In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-teams(a)first.org (includes CERT/CC) * bugtraq(a)securityfocus.com * vulnwatch(a)wulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.netsys.com * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------------+ | Revision | 2004-August-18 | Initial public | | 1.0 | | release. | +---------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/warp/public/707/sec_incident_response.shtml. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. - ---------------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQFBI2heezGozzK2tZARApWuAJ9hmienPQRYULzhMITiWgDd3qOGggCfflUY mTLgN7sQ7dF2G0THEwF6B4s= =zZm1 -----END PGP SIGNATURE-----

1 0

BGP-based blackholing/hijacking patented in Australia?
by Bevan Slattery 18 Aug '04

18 Aug '04

Hi, Just to ease peoples concerns, the patent has nothing to do with blackholing. A brief description of the way it works can be found here: http://www.scamslam.com/ScamSlam/whatis.shtml We have not disclosed the site address to the "public" at this stage, the text of the site is only draft form for the purposes of editing and needs to be "polished". Perhaps the article wasn't as articulate in conveying this, but I'm sure you appreciate journalists sometimes don't get it right :) Kind Regards Bevan Slattery PIPE Networks ______________________________________ PIPE Networks/IX Services Australia disclaimer The above email should be read in conjunction with our standard disclaimer/terms which can be found at : http://www.pipenetworks.com/docs/disclaimer.htm

10 13