September 2013 - Test - lists.nanog.org

BGP Attribute 128
by Jared Mauch 27 Sep '13

27 Sep '13

I'm curious how others are working with customers running code that drop the session with valid BGP attributes. Anyone else monitoring the proliferation of routes with attribute 128? I'm not really in favor of the features vendors have provided, such as this to just drop the attribute or routes. http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_bgp/configuration/xe-3s… - Jared

2 3

Re: iOS 7 update traffic
by Mark Lancaster 26 Sep '13

26 Sep '13

I have heard a lot of questions and debate about whether the iOS updates download automatically: “Available updates download automatically if your device is connected to Wi-Fi and a power source.” http://support.apple.com/kb/HT4623 <http://support.apple.com/kb/HT4623> /mark <http://support.apple.com/kb/HT4623> <http://support.apple.com/kb/HT4623>

3 2

Re: Sudan disconnected from the Internet
by Tammy Firefly 26 Sep '13

26 Sep '13

On 9/25/13 18:29:58, Jeff Kell wrote: > On 9/25/2013 8:25 PM, Tammy Firefly wrote: >> with the old fashioned pair of diagonal cutters applied to fiber? > > Yes, interesting to know if it was cut fiber, pressure on the inside > providers (or their feeds), or pressure on the outside providers. > > Traceroutes lend any clue? > > Jeff > If the government did it, I guarantee it was cut fiber. That makes it difficult to quickly restore. One has to wonder whats going on there right now that they dont want the world to know about?

11 15

Re: gmail.com contact
by Chris Conn 26 Sep '13

26 Sep '13

: > > -----Original Message----- > From: Markus [mailto:universe@truemetal.org] > Sent: 26 septembre 2013 07:37 > To: nanog(a)nanog.org > Subject: gmail.com contact > > Hi list, > > We had a user account compromised a couple of days ago, spam naturally, and now the IP is blocked for delivering to gmail.com. We've completed the delivery problem form at support.google.com but if there is any way to speed up the process our customer and we would appreciate it. Could anyone put me in touch with a gmail.com contact? > > Hi, Good luck. I have been going through the "regular channels" for over a month, to try and de-list a server that has not sent an email for over a month to Google or anyone for that matter, and no such luck. If you get a hold of somebody, pls forward me contact info. I am trying again this morning, I will do the same for you. Cheers, Chris

1 0

gmail.com contact
by Markus 26 Sep '13

26 Sep '13

Hi list, We had a user account compromised a couple of days ago, spam naturally, and now the IP is blocked for delivering to gmail.com. We've completed the delivery problem form at support.google.com but if there is any way to speed up the process our customer and we would appreciate it. Could anyone put me in touch with a gmail.com contact? Thanks! Markus

1 0

Sudan disconnected from the Internet
by Glen Kent 25 Sep '13

25 Sep '13

Hi, The report from renesys states that "We initially stated that Sudan’s outage began at 12:47 UTC because that was when virtually all Sudanese routed networks were withdrawn from the global routing table" http://www.renesys.com/2013/09/internet-blackout-sudan/ If its a deliberate action to remove Sudan from the Internet then what exactly would the ISPs in Sudan have done? Drop their peering sessions with the three International gateways? How were the "Sudanese routed networks withdrawn"? Glen

3 2

RE:The block message is 521 DNSRBL: Blocked for abuse
by Timothy Metzinger 25 Sep '13

25 Sep '13

Here's a thought. Would it be possible to set up a process where ARIN, as part of reselling IP addresses, either issues a certificate of transfer that the new owner can use to prove to the ISPs that he's a new owner and not the old evil spammer, or ARIN publishes a list of IP assignments that can be used by ISPs to provisionally remove them from blocked lists? I sympathize with the original poster, it's sort of like buying a used car, only to find out the previous owner was the drunk driver who ran over your next door neighbor's dog.

8 8

Cisco Security Advisory: Cisco IOS Software Resource Reservation Protocol Interface Queue Wedge Vulnerability
by Cisco Systems Product Security Incident Response Team 25 Sep '13

25 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS Software Resource Reservation Protocol Interface Queue Wedge Vulnerability Advisory ID: cisco-sa-20130925-rsvp Revision 1.0 For Public Release 2013 September 25 16:00 UTC (GMT) - ---------------------------------------------------------------------- Summary ======= A vulnerability in the Resource Reservation Protocol (RSVP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger an interface queue wedge on the affected device. The vulnerability is due to improper parsing of UDP RSVP packets. An attacker could exploit this vulnerability by sending UDP port 1698 RSVP packets to the vulnerable device. An exploit could cause Cisco IOS Software and Cisco IOS XE Software to incorrectly process incoming packets, resulting in an interface queue wedge, which can lead to loss of connectivity, loss of routing protocol adjacency, and other denial of service (DoS) conditions. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 25, 2013, Cisco IOS Software Security Advisory bundled publication includes eight Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the September 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep13.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlJC6Z4ACgkQUddfH3/BbTq2kwEAj4vA8C+M60R9Q3Ytrpq0jvRh HY+VBYi3HMwsH+PmACYA/iBdUCcbxAHyHmip/8yVjs44Ej2r4JLFfvg6vLCQ8o2G =kOF1 -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software Internet Key Exchange Memory Leak Vulnerability
by Cisco Systems Product Security Incident Response Team 25 Sep '13

25 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS Software Internet Key Exchange Memory Leak Vulnerability Advisory ID: cisco-sa-20130925-ike Revision 1.0 For Public Release 2013 September 25 16:00 UTC (GMT) - ---------------------------------------------------------------------- Summary ======= A vulnerability in the Internet Key Exchange (IKE) protocol of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak that could lead to a device reload. The vulnerability is due to incorrect handling of malformed IKE packets by the affected software. An attacker could exploit this vulnerability by sending crafted IKE packets to a device configured with features that leverage IKE version 1 (IKEv1). Although IKEv1 is automatically enabled on a Cisco IOS Software and Cisco IOS XE Software when IKEv1 or IKE version 2 (IKEv2) is configured, the vulnerability can be triggered only by sending a malformed IKEv1 packet. In specific conditions, normal IKEv1 packets can also cause an affected release of Cisco IOS Software to leak memory. Only IKEv1 is affected by this vulnerability. An exploit could cause Cisco IOS Software not to release allocated memory, causing a memory leak. A sustained attack may result in a device reload. Cisco has released free software updates that address this vulnerability. There are no workarounds to mitigate this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 25, 2013, Cisco IOS Software Security Advisory bundled publication includes eight Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the September 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep13.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlJC6Z0ACgkQUddfH3/BbTqlXwEAgh4+BJHc44EE50FqW2sNNo57 l9ZxzwJvzF2Tju/Fa18A/2MRGlAmkyvQZTQ/FT/j9wgW+epGNKAZ+XOL7Kwy6Luz =A0a+ -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software DHCP Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 25 Sep '13

25 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS Software DHCP Denial of Service Vulnerability Advisory ID: cisco-sa-20130925-dhcp Revision 1.0 For Public Release 2013 September 25 16:00 UTC (GMT) - ---------------------------------------------------------------------- Summary ======= A vulnerability in the DHCP implementation of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability occurs during the parsing of crafted DHCP packets. An attacker could exploit this vulnerability by sending crafted DHCP packets to an affected device that has the DHCP server or DHCP relay feature enabled. An exploit could allow the attacker to cause a reload of an affected device. Cisco has released free software updates that address this vulnerability. There are no workarounds to this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 25, 2013, Cisco IOS Software Security Advisory bundled publication includes eight Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the September 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep13.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlJC6Z0ACgkQUddfH3/BbToKcAD/Y0gUqLxw1mMs8yqeoREI7H7x /bU2ckuJKhhzJmmqpjEA/3ekjyVjTXoLRR9vQrYnAeJSE4opTRXYTlJtZesv4tIw =zzbX -----END PGP SIGNATURE-----

1 0