September 2013 - Test - lists.nanog.org

Cisco Security Advisory: Cisco IOS Software Queue Wedge Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 25 Sep '13

25 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS Software Queue Wedge Denial of Service Vulnerability Advisory ID: cisco-sa-20130925-wedge Revision 1.0 For Public Release 2013 September 25 16:00 UTC (GMT) - ---------------------------------------------------------------------- Summary ======= A vulnerability in the T1/E1 driver queue implementation of Cisco IOS Software could allow an unauthenticated, remote attacker to cause an interface wedge condition, which could lead to loss of connectivity, loss of routing protocol adjacency, and could result in a denial of service (DoS) scenario. The vulnerability is due to incorrect implementation of the T1/E1 driver queue. An attacker could exploit this vulnerability by sending bursty traffic through the affected interface driver. Repeated exploitation could cause a DoS condition. Workarounds to mitigate this vulnerability are available. Cisco has released free software updates that address this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 25, 2013, Cisco IOS Software Security Advisory bundled publication includes eight Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the September 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep13.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlJC6Z4ACgkQUddfH3/BbTpEGAD/Ss7zOJllV49QzpGTtRmbXsjK bgypwesmtU9UdOC39kUA/1FGKQ1kn08R7dJ2PcbbLo8PP0OCtQrSyxTeBtmcIsHw =xChY -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software Multicast Network Time Protocol Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 25 Sep '13

25 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS Software Multicast Network Time Protocol Denial of Service Vulnerability Advisory ID: cisco-sa-20130925-ntp Revision 1.0 For Public Release 2013 September 25 16:00 UTC (GMT) - ---------------------------------------------------------------------- Summary ======= A vulnerability in the implementation of the Network Time Protocol (NTP) feature in Cisco IOS Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to the improper handling of multicast NTP packets that are sent to an affected device encapsulated in a Multicast Source Discovery Protocol (MSDP) Source-Active (SA) message from a configured MSDP peer. An attacker could exploit this vulnerability by sending multicast NTP packets to an affected device. Repeated exploitation could result in a sustained DoS condition. Cisco has released free software updates that address this vulnerability. A workaround is available to mitigate this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 25, 2013, Cisco IOS Software Security Advisory bundled publication includes eight Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the September 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep13.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlJC6Z4ACgkQUddfH3/BbTrDQAD/ZDkeJZRsPNylydioU1nw+yJ+ 8frzFaXjO3g0qqocPjMA/R95PEhewfO2A29QwIyGKLw52QkiSt1sd6e2YsDIN84B =Xa3k -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software Zone-Based Firewall and Content Filtering Vulnerability
by Cisco Systems Product Security Incident Response Team 25 Sep '13

25 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS Software Zone-Based Firewall and Content Filtering Vulnerability Advisory ID: cisco-sa-20130925-cce Revision 1.0 For Public Release 2013 September 25 16:00 UTC (GMT) - ---------------------------------------------------------------------- Summary ======= A vulnerability in the Zone-Based Firewall (ZBFW) component of Cisco IOS Software could allow an unauthenticated, remote attacker to cause an affected device to hang or reload. The vulnerability is due to improper processing of specific HTTP packets when the device is configured for either Cisco IOS Content Filtering or HTTP application layer gateway (ALG) inspection. An attacker could exploit this vulnerability by sending specific HTTP packets through an affected device. An exploit could allow the attacker to cause an affected device to hang or reload. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 25, 2013, Cisco IOS Software Security Advisory bundled publication includes eight Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the September 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep13.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlJC6ZwACgkQUddfH3/BbTrfJAEAhPGE6zVhhuxL2YSSqZ9jQ7iB WSXFXha2WZL3zp//WtgA/3B0mrj1OwGNpUouOUDM20cvsxM8RGUUGJqn/UDgbdi4 =yiSp -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software Network Address Translation Vulnerabilities
by Cisco Systems Product Security Incident Response Team 25 Sep '13

25 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS Software Network Address Translation Vulnerabilities Advisory ID: cisco-sa-20130925-nat Revision 1.0 For Public Release 2013 September 25 16:00 UTC (GMT) - ---------------------------------------------------------------------- Summary ======= The Cisco IOS Software implementation of the network address translation (NAT) feature contains three vulnerabilities when translating IP packets that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are not available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 25, 2013, Cisco IOS Software Security Advisory bundled publication includes eight Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the September 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep13.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlJC6Z0ACgkQUddfH3/BbTqtUwD/fmE/9ONyzNjrIDni2UklV3M2 8ATQxEVFt1L3ZYUlyA4A/Ax+e0PiSL6ojL9bSgGIM7Y//+c7ga9nsau2mV5r/mhM =u9YC -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software IPv6 Virtual Fragmentation Reassembly Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 25 Sep '13

25 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS Software IPv6 Virtual Fragmentation Reassembly Denial of Service Vulnerability Advisory ID: cisco-sa-20130925-ipv6vfr Revision 1.0 For Public Release 2013 September 25 16:00 UTC (GMT) - ---------------------------------------------------------------------- Summary ======= A vulnerability in the implementation of the virtual fragmentation reassembly (VFR) feature for IP version 6 (IPv6) in Cisco IOS Software could allow an unauthenticated, remote attacker to cause an affected device to hang or reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a race condition while accessing the reassembly queue for IPv6 fragments. An attacker could exploit this vulnerability by sending a crafted stream of valid IPv6 fragments. Repeated exploitation may result in a sustained DoS condition. Cisco has released free software updates that address this vulnerability. There are no workarounds for this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 25, 2013, Cisco IOS Software Security Advisory bundled publication includes eight Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the September 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep13.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlJC6Z0ACgkQUddfH3/BbTon8QD+KjqV+g6xJtyPO04NuZLuUhZf nL+yvKaN2zd0d8DNTXYA/joTFXuponHnVUNni/h5NjU2MaS/ZphGQpuinPUZK5I4 =+5KL -----END PGP SIGNATURE-----

1 0

BGPlay as a parameter for upstream stability
by Fakrul Alam Pappu 25 Sep '13

25 Sep '13

To identify the stability/quality of upstream/transit provider; can we treat BGPlay output as a parameter? If yes, how authentic it would be. -Fakrul

1 0

RIPE NCC is Migrating the RIS Dashboard to RIPEstat
by Vesna Manojlovic 25 Sep '13

25 Sep '13

Dear colleagues, I would like to remind you of our announcement, made last month. In the coming days, we will be migrating RIS data visualisation to RIPEstat: http://stat.ripe.net We will, therefore, be decommissioning some of the outdated RIS interfaces and tools, and the old backend. We still welcome your feedback, so please let us know your comments so that we can accommodate your needs. More information can be found in the original announcement, below. Regards, Vesna Manojlovic Our Routing Information Service (RIS) has been collecting global BGP routing information for 12 years now. During this period, many different interfaces to analyse and visualise accumulated data have been developed. In line with our long-term goals to provide more consolidated services, we will be integrating the RIS interface's tools and services into RIPEstat. More information about this is detailed in a new RIPE Labs article: https://labs.ripe.net/Members/fatemah_mafi/improved-routing-information-ava… We invite the community to comment on these upcoming changes at MAT-WG: https://www.ripe.net/ripe/groups/wg/mat Please submit any requests for additional features via email to stat(a)ripe.net so that we can implement these along with the planned migration of tools and features, or have them added to the RIPEstat Roadmap for later consideration: http://roadmap.ripe.net/ripe-stat/ We look forward to your feedback. Regards, Vesna -- Vesna Manojlovic BECHA(a)ripe.net Senior Community Builder @Ms_Measurements for Measurements Tools RIPE NCC http://ripe.net

1 0

Re: iOS 7 update traffic
by Paul Ferguson 25 Sep '13

25 Sep '13

Can someone please explain to a non-Apple person what the hell happened that started generating so much traffic? Perhaps I missed it in this thread, but I would be curious to know what iOS 7 implemented that caused this... Thanks in adavnce, - ferg On 9/19/2013 10:23 AM, Nick Olsen wrote: > We also saw a huge spike in traffic. Still pretty high today as well. > We saw a ~60% above average hit yesterday, And we're at ~20-30% above > average today as well. > Being an android user, It didn't dawn on me until some of the IOS users in > the office started jumping up and down about IOS7 > Nick Olsen > Network Operations (855) FLSPEED x106 > > ---------------------------------------- > From: "Justin M. Streiner" <streiner(a)cluebyfour.org> > Sent: Wednesday, September 18, 2013 6:19 PM > To: "NANOG" <nanog(a)nanog.org> > Subject: Re: iOS 7 update traffic > > On Wed, 18 Sep 2013, Tassos Chatzithomaoglou wrote: > >> We also noticed an interesting spike (+ ~40%), mostly in akamai. >> The same happened on previous iOS too. > > I see it here, too. At its peak, our traffic levels were roughly double > what we would see on a normal weekday. > > jms > >> Zachary McGibbon wrote on 18/9/2013 20:38: >>> So iOS 7 just came out, here's the spike in our graphs going to our ISP >>> here at McGill, anyone else noticing a big spike? >>> >>> [image: internet-sw1 - Traffic - Te0/7 - To Internet1-srp (IR Canet) - >>> TenGigabitEthernet0/7] >>> >>> Zachary McGibbon >>> >> >> >> > > > > -- Paul Ferguson Vice President, Threat Intelligence Internet Identity, Tacoma, Washington USA IID --> "Connect and Collaborate" --> www.internetidentity.com

54 105

liveaction qos configurator
by david peahi 24 Sep '13

24 Sep '13

Any comments on live action Cisco qos configurator would be appreciated Regards David

1 0

Re: The block message is 521 DNSRBL: Blocked for abuse
by Andrew D Kirch 24 Sep '13

24 Sep '13

On 9/18/2013 7:15 PM, Tammy Firefly wrote: > On 9/18/13 5:07 PM, Andrew D Kirch wrote: >> On 9/18/2013 6:55 PM, Tammy Firefly wrote: >>>> I used to run the AHBL and ARIN used to contact us when they recycled IP >>>> space. We always removed when contacted by ARIN. >>>> >>>> Andrew >>>> >>> ARIN hasnt contacted us for this since i've been involved with the ahbl >>> for ~5 years. >>> just a FYI. >> Well, it'd seem we found the problem then. >> >> Andrew >> > Ive know ARIN is a problem for a lotta years andrew :P When we > contacted them and asked them to do it again we got told its against > policies blablablabla. > (replying to list with Tammy's permission) This is pathetic. ARIN is supposed to be working as a steward of this IP space. When you have policies that make it more difficult to use the IP space this isn't even remotely close to stewardship. It's pathetic, with the policy making a quick turn around of releasing old IP space when you get an allocation, that ARIN is leaving innocent third parties who have paid ARIN large sums of money for this space. ARIN, frankly you can suck it. It's time to grow up and behave how you were intended to. Andrew

7 10