April 2005 - Test - lists.nanog.org

RE: BGP Anywhere - Global Redundancy
by Vandy Hamidi 06 Apr '05

06 Apr '05

I definitely want 100% of traffic going towards the Primary Site during normal operation. LocalPref/MED can be controlled by community strings with my direct peers. As you said, I'm paying them for the service, but how will the advertisement behave after it propagates to their upstream peers? At that point AS Path should be the only determining factor, yes? Are ISP to ISP transit routes manipulated at MED or LocalPref levels? I suppose some ISPs may mark some peer with a preferential MED. I was turned on to BGP anywhere when reading up on UltraDNS. Looks like they use it for Global load balancing in which a DNS server on the East Coast will respond to DNS queries to my East Coast DC and the same for the west coast. They guarantee 100% DNS response, so I imagine it works for them. Has anyone on the list performed BGP Anywhere? There has to be someone on Nanog that has done this. Anyone from UltraDNS? -=Vandy=- -----Original Message----- From: Steve Gibbard [mailto:scg@gibbard.org] Sent: Wednesday, April 06, 2005 5:48 PM To: Vandy Hamidi Cc: nanog(a)merit.edu Subject: Re: BGP Anywhere - Global Redundancy On Wed, 6 Apr 2005, Vandy Hamidi wrote: > > All, > We're an ASP and are considering adding a secondary Backup Datacenter > (BDC) in the US to protect our web presence. > > My goal is to ensure automatic failover of my Primary DC's (IP) traffic > to the BDC in the event of a catastrophic failure of the PDC. > > I'm considering geographic load balancing and BGP Anywhere as the two > options. I'm clear on how the Geo LB works, but have some doubts about > BGPAW as I've never implemented it before and documentation online is > pretty weak to non-existent. > > Below is how I believe it should be done. >> From PDC: > -Advertise CIDR block to all peers w/good metric (0 hop count) >> From BDC: > -Advertise same CIDR block to all peers w/poor metric (+20 hop > count) To clarify, you want no traffic coming into the backup site when the primary site is up, right? Assuming a random set of peers and upstreams, this won't actually do what I think you're trying to do. Since local-preference overrides MEDs and AS path lengths, and since you don't have control over what goes on in other networks, you'll likely get some traffic coming into your backup site even when you don't intend it to. You could *maybe* get around this by having the same transit provider (probably just one in this case, which is scary for other reasons) in both locations. If you're paying somebody money, you have a much better chance of getting them to follow your desired routing policy. Still, it's really not good to be making a routing announcement somewhere where you don't want to receive traffic. You'd probably be better off looking into Cisco's "conditional routing" feature (I assume other vendors do something similar). This allows you to set a router to make an announcement only if it stops receiving some route, so you could have your backup site look for the primary site to go away and then start sourcing the route. Failover time would probably be at most a minute or two, maybe better. You could also look into various DNS-based ways of doing this. -Steve

2 1

Router choice for medium size hosting provider
by Alex Campbell 06 Apr '05

06 Apr '05

Hi everyone, I'm looking for a new router to connect our data center to our tier 1 ISP via a 50mbps fibre link. Does anyone have any advice about what level of Cisco router would be required to saturate this link? We're looking at the 2811 but I can't get any real world data about whether it can route packets at 50mbps - this seems doubtful although unclear from the information on the Cisco data sheets. (I'm aware that a cheap PC running Linux could provide similar throughput to a $20000 Cisco router but for a variety of reasons I'm reluctant to follow this path). Thanks, Alex

3 2

ping from the arone armies list
by Gadi Evron 06 Apr '05

06 Apr '05

Okay, we have slowly expanded our monthly reports to include more details. From what vendors actually do something about the problem, their success rates, numbers, etc. We intend to release more information in the future. This is a ping, to see what kind of other information you'd like to see. We'd appreciate your input. Gadi Evron.

1 0

Cisco Security Advisory: Vulnerabilities in Cisco IOS Secure Shell Server
by Cisco Systems Product Security Incident Response Team 06 Apr '05

06 Apr '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: ======================= Vulnerabilities in Cisco IOS Secure Shell Server ================================================ Revision 1.0 For Public Release 2005 April 06 1600 UTC (GMT) - ----------------------------------------------------------------------- Contents ======== Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice: FINAL Distribution Revision History Cisco Security Procedures - ----------------------------------------------------------------------- Summary ======= Certain release trains of Cisco Internetwork Operating System (IOS), when configured to use the IOS Secure Shell (SSH) server in combination with Terminal Access Controller Access Control System Plus (TACACS+) as a means to perform remote management tasks on IOS devices, may contain two vulnerabilities that can potentially cause IOS devices to exhaust resources and reload. Repeated exploitation of these vulnerabilities can result in a Denial of Service (DoS) condition. Use of SSH with Remote Authentication Dial In User Service (RADIUS) is not affected by these vulnerabilities. Cisco has made free software available to address these vulnerabilities for all affected customers. There are workarounds available to mitigate the effects of the vulnerability (see the Workarounds section.) This advisory will be posted at http://www.cisco.com/warp/public/707/cisco-sa-20050406-ssh.shtml. Affected Products ================= Vulnerable Products +------------------ These issues affect any Cisco device running an unfixed version of Cisco IOS that supports, and is configured to use, the SSH server functionality. To determine the software running on a Cisco product, log in to the device and issue the show version command to display the system banner. Cisco IOS Software will identify itself as "Internetwork Operating System Software" or simply "IOS." The image name will be displayed between parentheses shortly after this identification (possibly in the next line), followed by "Version" and the IOS release name. Other Cisco devices will not have the show version command or will give different output. The following example identifies a Cisco device running IOS release 12.2(15)T14 (release train label "12.2T") with an installed image name of C806-K9OSY6-M: Router1>show version Cisco Internetwork Operating System Software IOS (tm) C806 Software (C806-K9OSY6-M), Version 12.2(15)T14, RELEASE SOFTWARE (fc4) [...] The next example shows a device running IOS release 12.3(10) (release train label "12.3 mainline") with an image name of C2600-IK9OS3-M: Router2>show version Cisco Internetwork Operating System Software IOS (tm) C2600 Software (C2600-IK9O3S3-M), Version 12.3(10), RELEASE SOFTWARE (fc3) [...] Additional information about Cisco IOS release naming can be found at http://www.cisco.com/warp/public/620/1.html. SSH protocol was introduced in the following IOS release trains: * IOS 12.0S (SSH version 1) * IOS 12.1T (SSH version 1) * IOS 12.2 (SSH version 1) * IOS 12.2T (SSH version 1) * IOS 12.3T (SSH version 2) To determine if the IOS image that your IOS device is running supports the server side of the SSH protocol, whether it is enabled (if supported), and the SSH protocol version being used (if SSH is supported and enabled), use the show ip ssh command in global mode: Router>show ip ssh SSH Enabled - version 1.5 Authentication timeout: 120 secs; Authentication retries: 3 The previous output shows that SSH is enabled on this device and that the SSH protocol major version that is being supported is 1. Possible values for the SSH protocol version reported by IOS are: * 1.5: only SSH protocol version 1 is enabled. * 1.99: SSH protocol version 2 with SSH protocol version 1 compatibility enabled. * 2.0: only SSH protocol version 2 is enabled. For more information about SSH versions in IOS, please check the following URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/12…. Note: SSH protocols versions 1 and 2 cannot interoperate, but usually a SSH server knows how to handle connections from clients using either version of the protocol, but in most cases the server has to be explicitly configured to do this. The latest revision of protocol version 1 is "1.5", which is documented in a now expired Internet Engineering Task Force (IETF) draft. The show ip ssh command was introduced in IOS release 12.1(1)T. If this command is not available then the IOS image in use does not have SSH server support and therefore it is not vulnerable to the issues discussed in this advisory. As you will see in the Details section, the behavior of the vulnerabilities described in this document can depend on the version of the SSH protocol that the IOS device is using. Therefore, it is important to use the show ip ssh command as shown above to obtain this information. When the show ip ssh command is executed on an image that does not support SSH the following output will be generated: Router>show ip ssh ^ % Invalid input detected at '^' marker. Router> Finally, even if the release and image running on an IOS device support SSH, the SSH server may not be enabled. The following example shows the output from the show ip ssh command on a device that supports SSH but that does not have the SSH server enabled (note the "SSH Disabled" message): Router>sh ip ssh SSH Disabled - version 1.5 %Please create RSA keys to enable SSH. Authentication timeout: 120 secs; Authentication retries: 3 Router> Products Confirmed Not Vulnerable +-------------------------------- Devices not running IOS, running an IOS train without the SSH server functionality, or running an IOS version supporting SSH but without the SSH server enabled are not affected. See the Affected Products section for a detailed list of IOS release trains that implement the SSH functionality. In particular, the following IOS release train do not contain any SSH code: * All IOS versions prior to 12.0. * IOS 12.0 (mainline - the "S" train is affected.) * IOS 12.1 (mainline - the "T" train is affected.) * IOS 12.3 (mainline - the "T" train is affected.) Cisco IOS XR is not affected. No other Cisco products are currently known to be affected by these vulnerabilities. Details ======= Secure Shell (SSH) is a protocol that provides a secure, remote connection to a network device. There are currently two versions of the SSH protocol, SSH Version 1 and SSH Version 2, both of which are supported by Cisco IOS. The SSH server component of IOS identifies itself as version "1.5" if running only version 1.0 of the protocol, as version "2.0" if running only version 2 of the protocol, and as version "1.99" if running protocol version 2 with fall-back to protocol version 1. The SSH server feature of IOS enables a SSH client to make a secure, encrypted connection to a Cisco IOS device. This connection provides functionality that is similar to a telnet connection with the difference that all traffic between the server and the client, including authentication information, travels encrypted through the wires. TACACS provides a way to centrally validate users attempting to gain access to servers, workstations, routers, switches, access servers, and other network devices. The two vulnerabilities described in this document can cause denial of service (DoS) conditions that affect IOS devices configured to use the IOS SSH server feature for remote management. The first vulnerability may cause a device to reload when the IOS device is configured to act as a SSH version 2 server and any of the following events occurs: * The device is configured to authenticate users against a TACACS+ server (via a command like aaa authentication login <group name> group tacacs+ local) and the account username includes a domain name. Please note that the device is not affected if users are being authenticated against a RADIUS server or the local user database. * A new SSH session is in the authentication phase (the server is waiting for a username or password) and another, already logged-in user uses the send command. * Logging of messages is being directed to a SSH session that is already established (through the terminal monitor command) and the SSH session to the IOS device terminates while the SSH server is still sending data to the client. This vulnerability is documented in the Cisco bug ID CSCed65778 -- Crash in SSHv2 due to TACACS+ username containing domain name. Note: this vulnerability affects SSH protocol version 2. SSH protocol version 1 is not affected. The second vulnerability consists of a memory leak that happens when an IOS device is configured to authenticate SSH users against a TACACS+ server and the login fails due to an invalid username or password. This affects both SSH version 1 and version 2 connections. In the case of SSH version 2 connections, the memory leak occurs even after a successful login. Please note that the device is not affected if users are being authenticated against a RADIUS server or the local user database. The memory leak can be detected by running the command show tcp brief, like in the following example: Router#sh tcp brief TCB Local Address Foreign Address (state) 637202B8 10.0.0.19.13294 172.16.112.29.49 ESTAB 6371C978 10.0.0.19.13233 172.16.112.29.49 ESTAB 636CB228 10.0.0.19.13041 172.16.112.29.49 CLOSEWAIT 636B6900 10.0.0.19.12912 172.16.112.29.49 CLOSEWAIT 63697548 10.0.0.19.12848 172.16.112.29.49 CLOSEWAIT 63687930 10.0.0.19.12784 172.16.112.29.49 CLOSEWAIT 635F4A80 10.0.0.19.12659 172.16.112.29.49 CLOSEWAIT In the output above, those Transmission Control Blocks (TCBs) in the state CLOSEWAIT will not go away and represent memory leaks. Please note that only TCP connections with a foreign TCP port of 49 (the well-known port for TACACS) are relevant. This vulnerability is documented in the Cisco bug ID CSCed65285 -- SSH leaks memory and buffers. Impact ====== Successful exploitation of the vulnerability described in Cisco bug ID CSCed65778 may result in a reload of the device. Repeated exploitation could result in a sustained denial of service condition. Successful exploitation of the vulnerability described in Cisco bug ID CSCed65285 may result in resource depletion. Repeated exploitation could cause a reload of the device, which in turn could result in a sustained denial of service condition. Software Versions and Fixes =========================== Each row of the Cisco IOS software table (below) describes a release train and the platforms or products for which it is intended. If a given release train is vulnerable, then the earliest possible releases that contain the fix (the "First Fixed Release") and the anticipated date of availability for each are listed in the "Rebuild" and "Maintenance" columns. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. The release should be upgraded at least to the indicated release or a later version (greater than or equal to the First Fixed Release label). For further information on the terms "Rebuild" and "Maintenance" please consult the following URL: http://www.cisco.com/warp/public/620/1.html When considering software upgrades, please also consult http://www.cisco.com/en/US/products/products_security_advisories_listing.ht… and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") for assistance. +-------------------------------------------------------------+ | Major Release | Availability of Repaired Releases | |----------------------+--------------------------------------| | Affected 12.0-Based | Rebuild | Maintenance | | Release | | | |----------------------+------------------------+-------------| | | 12.0(26)S5 | | | |------------------------+-------------| | | 12.0(27)S4 | | | 12.0S |------------------------+-------------| | | 12.0(28)S2 | | | |------------------------+-------------| | | | 12.0(30)S | |----------------------+------------------------+-------------| | 12.0SX | | 12.0(30)SX | |----------------------+------------------------+-------------| | Affected 12.1-Based | Rebuild | Maintenance | | Release | | | |----------------------+------------------------+-------------| | 12.1AX | Migrate to 12.2(25)EY | | | | or later | | |----------------------+------------------------+-------------| | 12.1AZ | Migrate to 12.2(22)EA1 | | | | or later | | |----------------------+--------------------------------------| | 12.1DB | Migrate to 12.3(4)T11 or later | |----------------------+--------------------------------------| | 12.1DC | Migrate to 12.3(4)T11 or later | |----------------------+--------------------------------------| | 12.1E | | 12.1(23)E | |----------------------+------------------------+-------------| | 12.1EA | 12.1(22)EA1 | | |----------------------+------------------------+-------------| | 12.1EB | | 12.1(23)EB | |----------------------+--------------------------------------| | 12.1EC | Migrate to 12.3(9a)BC2 or later | |----------------------+--------------------------------------| | 12.1EU | Migrate to 12.2(20)EU or later | |----------------------+--------------------------------------| | 12.1EW | Migrate to 12.2(18)EW2 or later | |----------------------+--------------------------------------| | 12.1EX | Migrate to 12.1(23)E or later | |----------------------+--------------------------------------| | 12.1T | Migrate to 12.2(26) or later | |----------------------+--------------------------------------| | 12.1XD | Migrate to 12.2(26) or later | |----------------------+--------------------------------------| | 12.1XE | Migrate to 12.1(23)E or later | |----------------------+--------------------------------------| | 12.1XF | Migrate to 12.2(26) or later | |----------------------+--------------------------------------| | 12.1XG | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.1XH | Migrate to 12.2(26) or later | |----------------------+--------------------------------------| | 12.1XI | Migrate to 12.2(26) or later | |----------------------+--------------------------------------| | 12.1XL | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.1XM | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.1XP | Migrate to 12.2(26) or later | |----------------------+--------------------------------------| | 12.1XQ | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.1XR | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.1XT | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.1XU | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.1XV | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.1YA | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.1YB | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.1YC | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.1YD | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.1YE | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.1YF | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.1YH | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.1YI | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | Affected 12.2-Based | Rebuild | Maintenance | | Release | | | |----------------------+------------------------+-------------| | 12.2 | | 12.2(26) | |----------------------+--------------------------------------| | 12.2B | Migrate to 12.3(4)T11 or later | |----------------------+--------------------------------------| | 12.2DD | Migrate to 12.3(4)T11 or later | |----------------------+--------------------------------------| | 12.2DX | Migrate to 12.3(4)T11 or later | |----------------------+--------------------------------------| | 12.2EU | | 12.2(20)EU | |----------------------+------------------------+-------------| | | 12.2(18)EW2 | | | 12.2EW |------------------------+-------------| | | | 12.2(25)EW | |----------------------+------------------------+-------------| | 12.2EWA | | 12.2(20)EWA | |----------------------+--------------------------------------| | 12.2EX | Migrate to 12.2(25)SEA or later | |----------------------+--------------------------------------| | | 12.2(14)S13 | | | |------------------------+-------------| | | 12.2(18)S7 | | | |------------------------+-------------| | 12.2S | 12.2(20)S7 | | | |--------------------------------------| | | 12.2(22)S users Migrate to 12.2(25)S | | | or later | | |--------------------------------------| | | | 12.2(25)S | |----------------------+------------------------+-------------| | | 12.2(20)SE4 | | | 12.2SE |------------------------+-------------| | | | 12.2(25)SE | |----------------------+------------------------+-------------| | 12.2SEA | | 12.2(25)SEA | |----------------------+------------------------+-------------| | 12.2SEB | | 12.2(25)SEB | |----------------------+--------------------------------------| | 12.2SU | Migrate to 12.3(11)T3 or later | |----------------------+--------------------------------------| | 12.2SV | | 12.2(24)SV | |----------------------+--------------------------------------| | 12.2SX | Migrate to 12.2(17d)SXB1 or later | |----------------------+--------------------------------------| | 12.2SXA | Migrate to 12.2(17d)SXB1 or later | |----------------------+--------------------------------------| | 12.2SXB | 12.2(17d)SXB1 | | |----------------------+------------------------+-------------| | 12.2SXD | | 12.2(18)SXD | |----------------------+--------------------------------------| | 12.2SY | Migrate to 12.2(17d)SXB1 or later | |----------------------+--------------------------------------| | 12.2SZ | Migrate to 12.2(20)S7 or later | |----------------------+--------------------------------------| | | 12.2(11)T and earlier -- vulnerable | | 12.2T | | | | 12.2(13)T and later -- not | | | vulnerable | |----------------------+--------------------------------------| | 12.2XA | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.2XC | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.2XF | Migrate to 12.3(9a)BC2 or later | |----------------------+--------------------------------------| | 12.2XN | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.2XS | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.2YE | Migrate to 12.2S or later | |----------------------+--------------------------------------| | 12.2YK | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.2YO | Migrate to 12.2(17d)SXB1 | |----------------------+--------------------------------------| | 12.2YX | Migrate to 12.3(11)T3 or later | |----------------------+--------------------------------------| | 12.2YZ | Migrate to 12.2(20)S7 or later | |----------------------+--------------------------------------| | 12.2ZA | Migrate to 12.2(17d)SXB1 or later | |----------------------+--------------------------------------| | Affected 12.3-Based | Rebuild | Maintenance | | Release | | | |----------------------+------------------------+-------------| | | 12.3(4)T11 | | | |------------------------+-------------| | 12.3T | 12.3(7)T7 | | | |------------------------+-------------| | | | 12.3(8)T | |----------------------+--------------------------------------| | 12.3XD | Migrate to 12.3(7)T7 or later | |----------------------+--------------------------------------| | 12.3XE | Migrate to 12.3(8)T or later | |----------------------+--------------------------------------| | 12.3XF | Migrate to 12.3(11)T or later | |----------------------+--------------------------------------| | 12.3XG | Migrate to 12.3(11)T or later | |----------------------+--------------------------------------| | 12.3XH | Migrate to 12.3(11)T or later | |----------------------+--------------------------------------| | 12.3XI | 12.3(7)XI3 | | |----------------------+--------------------------------------| | 12.3XJ | Migrate to 12.3(8)XW | |----------------------+--------------------------------------| | 12.3XK | Migrate to 12.3(14)T | |----------------------+--------------------------------------| | 12.3XL | | 12.3(11)XL | |----------------------+------------------------+-------------| | 12.3XM | | 12.3(7)XM | |----------------------+------------------------+-------------| | 12.3XQ | 12.3(4)XQ1 | | |----------------------+------------------------+-------------| | 12.3XR | | 12.3(7)XR | |----------------------+------------------------+-------------| | 12.3XS | | 12.3(7)XS | |----------------------+------------------------+-------------| | 12.3XU | | 12.3(8)XU | |----------------------+------------------------+-------------| | 12.3XW | | 12.3(8)XW | |----------------------+------------------------+-------------| | 12.3XX | | 12.3(8)XX | |----------------------+------------------------+-------------| | 12.3XY | | 12.3(8)XY | |----------------------+------------------------+-------------| | 12.3YA | | 12.3(8)YA | |----------------------+------------------------+-------------| | 12.3YD | | 12.3(8)YD | |----------------------+------------------------+-------------| | 12.3YF | | 12.3(11)YF | |----------------------+------------------------+-------------| | 12.3YG | | 12.3(8)YG | |----------------------+------------------------+-------------| | 12.3YH | | 12.3(8)YH | |----------------------+------------------------+-------------| | 12.3YJ | | 12.3(11)YJ | |----------------------+------------------------+-------------| | 12.3YK | | 12.3(11)YK | +-------------------------------------------------------------+ Obtaining Fixed Software ======================== Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third-party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with the upgrade, which should be free of charge. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Please have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Please do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades. See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml Workarounds =========== The effectiveness of any workaround is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround is the most appropriate for use in the intended network before it is deployed. Mitigation Strategies +-------------------- Not all of the mitigation strategies listed will work for all customers. Some of the workarounds listed are dependent on which versions and feature-sets of IOS you have in your network. Configuring a VTY Access Class +----------------------------- It is possible to limit the exposure of the Cisco device by applying a VTY access class to permit only known, trusted hosts to connect to the device via SSH. For more information on restricting traffic to VTYs, please consult: http://cisco.com/en/US/products/sw/iosswrel/ps1835/products_command_referen…. The following example permits access to VTYs from the 192.168.1.0/24 netblock and the single IP address 172.16.1.2 while denying access from anywhere else: Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255 Router(config)# access-list 1 permit host 172.16.1.2 Router(config)# line vty 0 4 Router(config-line)# access-class 1 in Different Cisco platforms support different numbers of terminal lines. Check your device's configuration to determine the correct number of terminal lines for your platform. Configuring Access Lists (ACLs) +------------------------------ In addition to configuring a VTY Access Class, it may be desirable to block all SSH traffic destined to your network infrastructure. Telnet and reverse telnet should be blocked as part of a Transit ACL controlling all access to the trusted network. Transit ACLs are considered a network security best practice and should be considered as a long-term addition to good network security, as well as a workaround for this specific vulnerability. The white paper entitled "Transit Access Control Lists: Filtering at Your Edge" presents guidelines and recommended deployment techniques for transit ACLs: http://www.cisco.com/warp/public/707/tacl.html Configuring Infrastructure Access Lists (iACLs) +---------------------------------------------- Although it is often difficult to block traffic transiting your network, it is possible to identify traffic which should never be allowed to target your infrastructure devices and block that traffic at the border of your network. Infrastructure ACLs are considered a network security best practice and should be considered as a long-term addition to good network security as well as a workaround for this specific vulnerability. The white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection ACLs: http://www.cisco.com/warp/public/707/iacl.html Configuring Receive Access Lists (rACLs) +--------------------------------------- For distributed platforms, rACLs may be an option starting in Cisco IOS Software Versions 12.0(21)S2 for the 12000 series GSR and 12.0(24)S for the 7500 series. The receive access lists protect the device from harmful traffic before the traffic can impact the route processor. Receive path ACLs are considered a network security best practice, and should be considered as a long-term addition to good network security, as well as a workaround for this specific vulnerability. The CPU load is distributed to the line card processors and helps mitigate load on the main route processor. The white paper entitled "GSR: Receive Access Control Lists" will help identify and allow legitimate traffic to your device and deny all unwanted packets: http://www.cisco.com/warp/public/707/racl.html Control Plane Policing +--------------------- The Control Plane Policy (CoPP) feature may be used to mitigate this vulnerability, as in the following example: ! Do not police SSH traffic from trusted hosts access-list 140 deny tcp host <trusted host 1's IP address> any any eq 22 access-list 140 deny tcp host <trusted host 2's IP address> any any eq 22 [...] access-list 140 deny tcp host <trusted host N's IP address> any any eq 22 ! Trust an entire network if desired access-list 140 deny tcp <trusted network address> <trusted network mask> any eq 22 ! Police SSH traffic from untrusted hosts access-list 140 permit tcp any any eq 22 ! Do not police any other type of traffic going to the router access-list 140 deny ip any any ! class-map match-all ssh-class match access-group 140 ! policy-map control-plane-policy ! Drop all traffic that matches the class "icmp-class" class ssh-class drop ! control-plane service-policy input control-plane-policy Note: CoPP is available only in IOS release trains 12.0S, 12.2S and 12.3T. Additional information on the configuration and use of the CoPP feature can be found at the following URL: http://www.cisco.com/en/US/products/sw/iosswrel/ps1838/products_feature_gui… Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was discovered by Cisco during internal testing. Status of This Notice: FINAL ============================ THIS ADVISORY IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE ADVISORY OR MATERIALS LINKED FROM THE ADVISORY IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS NOTICE AT ANY TIME. A stand-alone copy or paraphrase of the text of this security advisory that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory will be posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20050406-ssh.shtml. In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-teams(a)first.org (includes CERT/CC) * bugtraq(a)securityfocus.com * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +-------------------------------------------------------------+ | Revision 1.0 | 2005-April-06 | Initial Public Release | +-------------------------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…. This includes instructions for press inquiries regarding Cisco security notices.All Cisco security advisories are available at http://www.cisco.com/go/psirt. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) iD8DBQFCVB0BezGozzK2tZARApPtAKDK8M9Plij3lTXGpd9XQaEjzfOx0QCg5OZN b1TkAVAtNvK3ne/TrII+P8Q= =TN0K -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Vulnerabilities in the Internet Key Exchange Xauth Implementation
by Cisco Systems Product Security Incident Response Team 06 Apr '05

06 Apr '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: ======================== Vulnerabilities in the Internet Key Exchange Xauth Implementation ================================================================= Revision 1.0 For Public Release 2005 April 6 1600 UTC - ------------------------------------------------------------------------------- Contents Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice: FINAL Distribution Revision History Cisco Security Procedures - ------------------------------------------------------------------------------- Summary ======= Cisco Internetwork Operating System (IOS) Software release trains 12.2T, 12.3 and 12.3T may contain vulnerabilities in processing certain Internet Key Exchange (IKE) Xauth messages when configured to be an Easy VPN Server. Successful exploitation of these vulnerabilities may permit an unauthorized user to complete authentication and potentially access network resources. This advisory will be posted to http://www.cisco.com/warp/public/707/cisco-sa-20050406-xauth.shtml Cisco has made free software available to address this vulnerability for affected customers. Affected Products ================= Vulnerable Products +------------------ This issue affects all Cisco devices running any unfixed version of Cisco IOS that supports, and is configured for, Cisco Easy VPN Server Xauth version 6 authentication. A Cisco device running Easy VPN Server and configured for Xauth authentication will have the following line in the configuration: crypto map <mapname> client authentication list <listname> The Easy VPN Server XAUTH feature may also be enabled underneath an ISAKMP profile via a configuration similar to: crypto isakmp profile <profilename> match identity group <groupname> client authentication list <listname> isakmp authentication list <listname> client configuration address respond qos-group 2 To determine the software running on a Cisco product, log in to the device and issue the 'show version' command to display the system banner. Cisco IOS Software will identify itself as "Internetwork Operating System Software" or simply "IOS." On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the IOS release name. Other Cisco devices will not have the show version command or will give different output. The following example identifies a Cisco product running IOS release 12.3(6) with an installed image name of C3640-I-M: Cisco Internetwork Operating System Software IOS (tm) 3600 Software (C3640-I-M), Version 12.3(6), RELEASE SOFTWARE (fc3) The next example shows a product running IOS release 12.3(11)T3 with an image name of C3845-ADVIPSERVICESK9-M: Cisco IOS Software, 3800 Software (C3845-ADVIPSERVICESK9-M), Version 12.3(11)T3, RELEASE SOFTWARE (fc4) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2005 by Cisco Systems, Inc. Additional information about Cisco IOS release naming can be found at http://www.cisco.com/warp/public/620/1.html. Cisco Easy VPN Server is an IOS-only feature. Devices that do not run IOS are not vulnerable. No other Cisco products are currently known to be affected by these vulnerabilities. Details ======= IPSec is a framework of open standards that provides data confidentiality, data integrity, and data authentication between participating peers. IPSec provides these security services at the IP layer allowing for data to be transmitted across a public network without fear of observation, modification, or spoofing, thus enabling applications such as Virtual Private Networks (VPNs). IPSec uses the Internet Key Exchange (IKE) protocol to provide authentication of the IPSec peers, negotiate IPSec security associations (SA), and establish IPSec keys. Extended Authentication (XAUTH) is an extension to IKE defined in an expired Internet Engineering Task Force (IETF) Internet Draft, draft-ietf-ipsec-isakmp-xauth-06.txt, which allows for organizations to utilize existing legacy authentication methods in order to manage remote access. Successful VPN establishment consists of two levels of SA's known as phases. Phase 1 authentication establishes session keys. Using the Xauth feature, the client waits for a "username/password" challenge after the IKE Phase 1 SA has been established. When the end user responds to the challenge, the response is forwarded to the IPsec peers for an additional level of authentication. The Cisco IOS Easy VPN Server feature introduced in IOS 12.2(8)T allows an IOS device to act as a VPN concentrator, providing authentication and encrypted access to network resources. To determine if Cisco's Easy VPN Server XAUTH feature is enabled, check the device's configuration for the following line: crypto map <mapname> client authentication list <listname> The Easy VPN Server XAUTH feature may also be enabled underneath an ISAKMP profile via a configuration similar to: crypto isakmp profile <profilename> match identity group <groupname> client authentication list <listname> isakmp authentication list <listname> client configuration address respond qos-group 2 Certain packets sent to the IOS Easy VPN Server listening on User Datgram Protocol (UDP) port 500 may permit an unauthorized user to complete Xauth authentication and thereby gain access to network resources. In order for the attack to succeed, an attacker must know the shared group key to complete the IKE Phase 1 negotiation before the Xauth negotiation takes place. This malformed packet vulnerability is documented as Cisco Bug ID CSCin82407. A second vulnerability exists in a feature introduced in IOS 12.3(8)T where an ISAKMP profile can be assigned to a remote access peer based on the certificate the peer uses during IKE negotiation. If the ISAKMP profile mandates XAUTH (AAA authentication and authorization lists are configured in the profile), then the peer must perform XAUTH authentication after Phase 1 negotiation. A vulnerability exists where the ISAKMP profile is assigned but the attributes that are configured in the ISAKMP profile are not processed. This can result in a situtation where both the VPN client and VPN server are expecting to hear something from the other end of the connection. Normally this deadlock will be broken by idle timers tearing down the SA, but it is possible for a malicious client to propose Phase 2 negotiation during this time which may allow for the IPSec SA to be fully established. This issue only affects ISAKMP profiles matched by certificate maps. Configurations with certificate maps configured will contain the commands: crypto isakmp profile <profilename> match certificate <mapname> This vulnerability is documented as Cisco Bug ID CSCeg00277. Impact ====== Successful exploitation may result in the affected device allowing an unauthorized user to complete authentication and access network resources. Software Versions and Fixes =========================== Each row of the Cisco IOS software table (below) describes a release train and the platforms or products for which it is intended. If a given release train is vulnerable, then the earliest possible releases that contain the fix (the "First Fixed Release") and the anticipated date of availability for each are listed in the "Rebuild" and "Maintenance" columns. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. The release should be upgraded at least to the indicated release or a later version (greater than or equal to the First Fixed Release label). For further information on the terms "Rebuild" and "Maintenance" please consult the following URL: http://www.cisco.com/warp/public/620/1.html When considering software upgrades, please also consult http://www.cisco.com/en/US/products/products_security_advisories_listing.ht… and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") for assistance. +-------------------------------------------------------------+ | Major Release | Availability of Repaired Releases | |---------------------+---------------------------------------| | Affected 12.2-Based | Rebuild | Maintenance | | Release | | | |---------------------+---------------------------------------| | 12.2B | Migrate to 12.3(4)T8 or later | |---------------------+---------------------------------------| | | 12.2(15)BC1f | | | 12.2BC |--------------------+------------------| | | 12.2(15)BC2e | | |---------------------+---------------------------------------| | 12.2BX | Vulnerable, contact TAC | |---------------------+---------------------------------------| | 12.2BY | Migrate to 12.3(4)T8 or later | |---------------------+---------------------------------------| | 12.2BZ | Vulnerable, contact TAC | |---------------------+---------------------------------------| | 12.2CX | Migrate to 12.3(9a)BC | |---------------------+---------------------------------------| | 12.2CY | Migrate to 12.2(15)BC1f or 12.2(15) | | | BC2e | |---------------------+---------------------------------------| | 12.2CZ | 12.2(15)CZ1 | | |---------------------+--------------------+------------------| | 12.2JK | 12.2(15)JK2 | | |---------------------+--------------------+------------------| | 12.2SU | 12.2(14)SU2 | | |---------------------+---------------------------------------| | 12.2SX | Migrate to 12.2(17d)SXB5 | |---------------------+---------------------------------------| | 12.2SXA | Migrate to 12.2(17d)SXB5 | |---------------------+---------------------------------------| | 12.2SXB | 12.2(17d)SXB5 | |---------------------+---------------------------------------| | 12.2SXD | 12.2(18)SXD1 | | |---------------------+---------------------------------------| | 12.2SY | Migrate to 12.2(17d)SXB5 | |---------------------+---------------------------------------| | 12.2T | Migrate to 12.3 or later | |---------------------+---------------------------------------| | 12.2XJ | Migrate to 12.3 or later | |---------------------+---------------------------------------| | 12.2XK | Migrate to 12.3 or later | |---------------------+---------------------------------------| | 12.2XL | Migrate to 12.3 or later | |---------------------+---------------------------------------| | 12.2XM | Migrate to 12.3 or later | |---------------------+---------------------------------------| | 12.2XW | Migrate to 12.3 or later | |---------------------+---------------------------------------| | 12.2XZ | Migrate to 12.3 or later | |---------------------+---------------------------------------| | 12.2YA | 12.2(4)YA8 | | |---------------------+---------------------------------------| | 12.2YB | Migrate to 12.3 or later | |---------------------+---------------------------------------| | 12.2YD | Migrate to 12.3(8)T5 or later | |---------------------+---------------------------------------| | 12.2YF | Migrate to 12.3 or later | |---------------------+---------------------------------------| | 12.2YG | Migrate to 12.3 or later | |---------------------+---------------------------------------| | 12.2YH | Migrate to 12.3 or later | |---------------------+---------------------------------------| | 12.2YJ | Migrate to 12.3 or later | |---------------------+---------------------------------------| | 12.2YL | Migrate to 12.3T or later | |---------------------+---------------------------------------| | 12.2YM | Migrate to 12.3T or later | |---------------------+---------------------------------------| | 12.2YN | Migrate to 12.3T or later | |---------------------+---------------------------------------| | 12.2YP | Migrate to 12.3 or later | |---------------------+---------------------------------------| | 12.2YQ | Migrate to 12.3(4)T8 or later | |---------------------+---------------------------------------| | 12.2YR | Migrate to 12.3(4)T8 or later | |---------------------+---------------------------------------| | 12.2YT | Migrate to 12.3 or later | |---------------------+---------------------------------------| | 12.2YU | Migrate to 12.3T or later | |---------------------+---------------------------------------| | 12.2YV | Migrate to 12.3(4)T8 or later | |---------------------+---------------------------------------| | 12.2YW | Migrate to 12.3T or later | |---------------------+---------------------------------------| | 12.2YX | Migrate to 12.2(14)SU2 or later | |---------------------+---------------------------------------| | 12.2YY | Migrate to 12.3T or later | |---------------------+---------------------------------------| | 12.2ZB | Migrate to 12.3T or later | |---------------------+---------------------------------------| | 12.2ZC | Migrate to 12.3T or later | |---------------------+---------------------------------------| | 12.2ZD | Migrate to 12.3(14)T | |---------------------+---------------------------------------| | 12.2ZE | Migrate to 12.3 or later | |---------------------+---------------------------------------| | 12.2ZF | Migrate to 12.3(4)T8 or later | |---------------------+---------------------------------------| | 12.2ZG | Migrate to 12.3(4)T8 or later | |---------------------+---------------------------------------| | 12.2ZH | 12.2(13)ZH5 | | |---------------------+---------------------------------------| | 12.2ZJ | Migrate to 12.3T or later | |---------------------+---------------------------------------| | 12.2ZK | Contact TAC | |---------------------+---------------------------------------| | 12.2ZL | 12.2(15)ZL2 | | | | available TBD | | |---------------------+---------------------------------------| | 12.2ZN | Migrate to 12.3T or later | |---------------------+---------------------------------------| | 12.2ZP | Contact TAC | |---------------------+---------------------------------------| | Affected 12.3-Based | Rebuild | Maintenance | | Release | | | |---------------------+--------------------+------------------| | | 12.3(6e) | | | |--------------------+------------------| | | 12.3(9c) | | | 12.3 |--------------------+------------------| | | 12.3(10a) | | | |--------------------+------------------| | | | 12.3(12) | |---------------------+--------------------+------------------| | 12.3B | 12.3(5a)B3 | | |---------------------+--------------------+------------------| | 12.3BC | 12.3(9a)BC | | |---------------------+---------------------------------------| | 12.3BW | Migrate to 12.3(7)T6 or later | |---------------------+---------------------------------------| | | 12.3(2)T9 | | | |--------------------+------------------| | | 12.3(4)T8 | | | |--------------------+------------------| | | 12.3(7)T7 | | | 12.3T |--------------------+------------------| | | 12.3(8)T5 | | | |--------------------+------------------| | | 12.3(11)T2 | | | |--------------------+------------------| | | | 12.3(14)T | |---------------------+--------------------+------------------| | 12.3XA | 12.3(2)XA3 | | | | available TBD | | |---------------------+---------------------------------------| | 12.3XB | Migrate to 12.3(8)T5 or later | |---------------------+---------------------------------------| | 12.3XC | 12.3(2)XC3 | | | | available TBD | | |---------------------+--------------------+------------------| | 12.3XD | 12.3(4)XD4 | | |---------------------+--------------------+------------------| | 12.3XE | 12.3(2)XE1 | | |---------------------+---------------------------------------| | 12.3XF | Migrate to 12.3(11)T2 or later | |---------------------+---------------------------------------| | 12.3XG | 12.3(4)XG2 | | |---------------------+---------------------------------------| | 12.3XH | Migrate to 12.3(11)T2 or later | |---------------------+---------------------------------------| | 12.3XI | Contact TAC | |---------------------+---------------------------------------| | 12.3XJ | Contact TAC | |---------------------+---------------------------------------| | 12.3XK | Migrate to 12.3(11)T2 or later | |---------------------+---------------------------------------| | 12.3XL | | 12.3(11)XL | |---------------------+---------------------------------------| | 12.3XM | Migrate to 12.3(14)T or later | |---------------------+---------------------------------------| | 12.3XN | Migrate to 12.3(14)T or later | |---------------------+---------------------------------------| | 12.3XQ | 12.3(4)XQ1 | | |---------------------+--------------------+------------------| | 12.3XR | 12.3(7)XR3 | | |---------------------+--------------------+------------------| | 12.3XS | 12.3(7)XS2 | | |---------------------+---------------------------------------| | 12.3XT | Contact TAC | |---------------------+---------------------------------------| | 12.3XU | 12.3(8)XU3 | | |---------------------+---------------------------------------| | 12.3XW | Contact TAC | |---------------------+---------------------------------------| | 12.3XX | 12.3(8)XX1 | | |---------------------+---------------------------------------| | 12.3XY | Migrate to 12.3(14)T | |---------------------+---------------------------------------| | 12.3YA | 12.3(8)YA1 | | |---------------------+--------------------+------------------| | 12.3YC | 12.3(8)YC1 | | |---------------------+--------------------+------------------| | 12.3YD | | 12.3(8)YD | |---------------------+--------------------+------------------| | 12.3YF | | 12.3(11)YF | |---------------------+--------------------+------------------| | 12.3YG | | 12.3(8)YG1 | |---------------------+--------------------+------------------| | 12.3YH | | 12.3(8)YH | |---------------------+--------------------+------------------| | 12.3YI | | 12.3(8)YI | | | | available TBD | |---------------------+--------------------+------------------| | 12.3YJ | | 12.3(11)YJ | |---------------------+--------------------+------------------| | 12.3YK | | 12.3(11)YK | +-------------------------------------------------------------+ Obtaining Fixed Software ======================== Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third-party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with the upgrade, which should be free of charge. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Please have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Please do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades. See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Workarounds =========== The effectiveness of any workaround is dependent on specific deployment scenarios such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround is the most appropriate for use in the intended network before it is deployed. Using Strong Group Passwords +--------------------------- Because the preshared group password (also referred to as the group key) must be known by an attacker, the use of a best practice to deploy strong preshared group keys may mitigate a brute-force attack against this group key. The preshared key can be changed by using the following configuration commands: Router(config)#crypto isakmp client configuration group <group-name> Router(config)#key <key> Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. Both vulnerabilities were reported by Cisco customers Status of This Notice: FINAL ============================ THIS ADVISORY IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE ADVISORY OR MATERIALS LINKED FROM THE ADVISORY IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS NOTICE AT ANY TIME. A stand-alone copy or paraphrase of the text of this security advisory that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory will be posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20050406-xauth.shtml. In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-teams(a)first.org (includes CERT/CC) * bugtraq(a)securityfocus.com * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +--------------------------------------------------------------+ | Revision 1.0 | 2005-April-6 | Initial public release. | +--------------------------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.… . This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt/. - ------------------------------------------------------------------------------- All contents are Copyright 1992-2005 Cisco Systems, Inc. All rights reserved. - ------------------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (SunOS) iD8DBQFCU/75ezGozzK2tZARAukpAKDwP3ZTuNDbxsvyT9cdoIT6mPSjNACeKugC jjNxqlwYPg7uZ7qBlG/OY3g= =5Ue0 -----END PGP SIGNATURE-----

1 0

Re: rack-mount tool drawers/chests?
by Brandon Butterworth 06 Apr '05

06 Apr '05

Depends on your choice of tools but these are handy - http://www.canford.co.uk/commerce/resources/catdetails/2458.pdf http://www.canford.co.uk/commerce/resources/catdetails/2457.pdf http://www.canford.co.uk/commerce/resources/catdetails/2628.pdf

1 0

rack-mount tool drawers/chests?
by Eric A. Hall 06 Apr '05

06 Apr '05

anybody recommend any 19" rackmount tool drawers or chests? like, a Snap-On red metal tool chest with locking drawers and such? I've looked around but can't find anything, although I'm probably not looking in the right places. thanks -- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/

3 2

RIPE50: Peering BoF
by Cara Mascini 06 Apr '05

06 Apr '05

North American Network Operators, Since quite a few of you are also attending the RIPE meetings Susan though it would be a good idea for me to mention that a (European) Peering BoF will take place in Stockholm at RIPE50 on Sunday 1st May 2005 and from 18.00 to around 21.00. The format will be fairly informal and provide interested parties with an opportunity of presenting their peering policies to the participants (in a set format). Time permitting, anyone expressing an interest in presenting their policy will be given the opportunity to do so. Of course seeing the timing of the session there will be some food to keep the participants happy. And no Peering BoF would be complete without the mandatory free beer at the end of it which is brought to the participants in the interests of "social networking" by a number of European IXPs. Anyone interested can let me know by return whether you are interested in attending/presenting. Regards, Cara Mascini

2 1

Keeping up with daylight savings time, datacenter style
by Bill Woodcock 06 Apr '05

06 Apr '05

http://www.inovadisplays.com/clocks/poe.php -Bill

1 0

The Register: .net report speared a third time
by Fergie (Paul Ferguson) 05 Apr '05

05 Apr '05

The Register: "The .net report has been speared a third time - by bidder Sentan." http://www.theregister.co.uk/2005/04/05/sentan_slams_dot_net_report/ - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

2 1