March 2014 - Test - lists.nanog.org

Cisco Security Advisory: Cisco IOS Software Internet Key Exchange Version 2 Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 26 Mar '14

26 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco IOS Software Internet Key Exchange Version 2 Denial of Service Vulnerability Advisory ID: cisco-sa-20140326-ikev2 Revision 1.0 For Public Release 2014 March 26 16:00 UTC (GMT) Summary ======= A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of the affected device that would lead to a denial of service (DoS) condition. The vulnerability is due to how an affected device processes certain malformed IKEv2 packets. An attacker could exploit this vulnerability by sending malformed IKEv2 packets to an affected device to be processed. An exploit could allow the attacker to cause a reload of the affected device that would lead to a DoS condition. Although IKEv2 is automatically enabled on Cisco IOS Software and Cisco IOS XE Software devices when the Internet Security Association and Key Management Protocol (ISAKMP) is enabled, the vulnerability can be triggered only by sending a malformed IKEv2 packet. Only IKEv2 packets can trigger this vulnerability. Cisco has released free software updates that address this vulnerability. There are no workarounds to mitigate this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The March 26, 2014, Cisco IOS Software Security Advisory bundled publication includes six Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2014 bundled publication. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar14.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJTMeUtAAoJEIpI1I6i1Mx3JYsQAJSSBgUo2Fq6HUJ1Rq/YlpEf S0FE1xiO9M+pD9w+gloAm+r86TTVrvi8eTsguHnm9I7aZBkKK72Fr6en/ywx7+c2 vqNt7sgfu2EHsK45zgYFMzYIOGomydamV6YixO7wvrnhWKjAHfcO51Ks7SPam2y2 2nTAGnifDcbQGcuneKyr61aob361E1UYpqlq4CK0+hEbx9VzCM2DuidiAOqCgtlA xtzw8Eu/8PP0baBi2DM7N/wlMMVTHNLXguSJNvsQxMnkvyoPObCXucSRvAPb5lSh s38f0kZKQSLcVorkelzT5G7Ht7PxqFJAeghongQW77XEoQ0ERi/isuKHKM16AM+F NCMrWeeNCw3Fcpp9lFu7dmnQx/CAdApB26UEnRifN5dp+wPxk7Jzb/Y/H5jMH+vr XxpzCGvDD8Nlm6PaBbP/leezuBUjWv61xKeeJup/thsl6/lJVsrgFScvQNfXP49x IwPvgFx+u67PIkE0+873+JmrPENNUAY7Le6OmA6UyCewY4seDByEbG9AdigmQAR4 yWUUTe2iFAYKuVKshcrOnCX83qM2K6RNBTbQXS0YrE0gx/f71PdiEs4jiUeSh9aO rJsqX1EJa5QWeOgSlSpNJs/RCs1szchnYcKA2FGmF7sQPYHehY5X8rOistgSCRyd SUNxQ9T/HDRmOpXM85n8 =XFWb -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco 7600 Series Route Switch Processor 720 with 10 Gigabit Ethernet Uplinks Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 26 Mar '14

26 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco 7600 Series Route Switch Processor 720 with 10 Gigabit Ethernet Uplinks Denial of Service Vulnerability Advisory ID: cisco-sa-20140326-RSP72010GE Revision 1.0 For Public Release 2014 March 26 16:00 UTC (GMT) Summary ======= A vulnerability in the Cisco 7600 Series Route Switch Processor 720 with 10 Gigabit Ethernet Uplinks models RSP720-3C-10GE and RSP720-3CXL-10GE could allow an unauthenticated, remote attacker to cause the route processor to reboot or stop forwarding traffic. The vulnerability is due to an issue in the Kailash field-programmable gate array (FPGA) versions prior to 2.6. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The March 26, 2014, Cisco IOS Software Security Advisory bundled publication includes six Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2014 bundled publication. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar14.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJTMeUsAAoJEIpI1I6i1Mx3QqEP/1W/RvtG5zkMAVcGxT/fmT57 YsEGW6+znRSsE7VLq4R6040SQYqJemtkdrug6PB5Ie1IWySd6Qv6FA5nAwtrRqaY aSyVSxXt0ta+zmoSlYqidQl+X+oLTWf4hbkKae2DUqlPSoRadyKzp4Fz6GARolka V1P6dCwXKYo+y8444cilT5iw28RajMYDFVBv8pl1j1O20ts8gLskq1sqQaZneYKZ dS8N4yaIOtRp+6hMtH3dcRDm0dy880l4yrBN+4sOC/Pf/oTRiwkhYUXZaDqOme4R K1rWArmc9tkFMGar5j4wVWYk0B8cdOu5+FQ/1hbd2PxgLpvFylDZ/5W83hnK9J4g HTgE9vQ3BDeJkoxLupOksTRxqYgxUzYCs1LfcCNoNbQTOs8tAidQyzng3Rhw3/Ty mB3dTOaR1giqnnp6HNbRzxmw1j7m2kOfkoNhrcLMcO+2R+SaBmG4IHtRoEeABGdc H19Nv7Y/GFug1AY9ntHOyMw1urVa7Dperb22mSqeeF4HPZoYlAYJG0itwkpmdI+R E8STnyi+Hx2LmjEUc59SSLpS0n1ciBRii6CG+hFUUPCDdyJpdGYgVYbOtn3g0YHw 5OR4qK2/hWNOFQ+6DIjhYvXecLEmGltJ1rMxdFdtgH5JT2IAZsdoUHko9b9PRTJ7 J+6y3e8dU2EfXhK7GuFA =RDpO -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 26 Mar '14

26 Mar '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability Advisory ID: cisco-sa-20140326-sip Revision 1.0 For Public Release 2014 March 26 16:00 UTC (GMT) Summary ======= A vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device. To exploit this vulnerability, affected devices must be configured to process SIP messages. Limited Cisco IOS Software and Cisco IOS XE Software releases are affected. Cisco has released free software updates that address this vulnerability. There are no workarounds for devices that must run SIP; however, mitigations are available to limit exposure to this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The March 26, 2014, Cisco IOS Software Security Advisory bundled publication includes six Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2014 bundled publication. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar14.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJTMeUuAAoJEIpI1I6i1Mx3NjYP/0etuiRKILQ2sFGrwyA+vUc+ af04L8J24D4/7/qQJ9YsZekjol0u0+vJIhHEMzqeRKiv4qUwHudtzgDLn6svASRR djFwz5QzPkrheF/Xk+tKT4NkDcPrr4MWH5j8zRltfYdRgQHVzGeV7u6JorOAlV3b m8Tkg6+sl4rTBw0tky8swM5H35p9UOnDzlFlzx6WNUGZFrv83wbj9L2ZdcDzXSdl 0jXw1xue9DEpksC3A2KNq9zIrizEJGfx97jhhRG0OsK/3gbO3ESFGr6wbkakLZNS WJmCgk82tiT2mM8/FulyPvdpuDAc5y0br+W0I0O0gABZmOoix0DT3NlJXh5hd48y 5iJ5s15D0Og3jJq3nzC8U2za+lMLcDsm4WGgWsY7UvzMWJ24u1Q4LP0Ios5r7bHV MF9CyWSxxqFO3pWBQw53HZhBDmk4rl3iDHSAytHVEjNlrmKAY/Q5MHZpMER1yQIO O9ER61S6eXTS6yCcoFf7cpdBvZR08C9PS/geOmv+5znJ4AbpzCdrQYUDZlcL/DhW jGZ/cvgytw3zPYozPYSFqnB/aadcA3xHeTjba9qsHlo8tAlJqUGIlIzzGsag1yuW rUSjLrnEUDiy0cGxq/tZsERiyUVWtafsc/F6/dshp27LB7Ih8ulOvpTEIMzZKAnv 8sx8s3vq7KEIpWUpj1ak =e0Cj -----END PGP SIGNATURE-----

1 0

BiLateral Transit Agreements?
by Jack Bates 26 Mar '14

26 Mar '14

Does anyone have experience with BiLateral Transit Agreements, compared to the same with Peering Agreements? I have 2 ISP customers that are looking at such an agreement. While I can modify the standard BLPA templates to support transit provisions, I was curious if anyone had done so and what pitfalls to look for or considerations that should be made. Our particular case is high cost transport, so both companies are looking at each having a Tier 1 transit and then supporting the second through their agreement. Jack Bates

1 0

Assistance Exporting MRTG graph data
by Joseph M. Owino 26 Mar '14

26 Mar '14

Hi, I recently changed my monitoring server and would like to know how someone can export MRTG data so that there are no breaks in the graph data? regards Joseph Muga Owino Technical Officer TESPOK Cell: 0721-930-681 twitter.com/jpmuga Zimbra Blog: Celebrate! It’s Community Manager Appreciation Day! http://bit.ly/1e3C1cq

2 1

DNSSEC in .au
by Adam King 26 Mar '14

26 Mar '14

auDA has announced it will be introducing DNSSEC into the .au domain space in an experimental capacity. Deployment on production servers will commence during April and will be trialled for 4 months. The .au DS records will_not be added to the root zone during this period. Operators should_not create or implement trust anchors for .au in their production environments during this experimental phase. A mailing list has been created for all future announcements related to DNSSEC in .au, if you wish to subscribe to this mailing list please visit http://www.lists.auda.org.au/mailman/listinfo/dnssec-announce For further information about the implementation of DNSSEC in .au please see http://www.auda.org.au/industry-information/au-domains/dnssec/. Kind Regards, Adam King | CTO .au Domain Administration Ltd T: +61 3 8341 4111 | F: +61 3 8341 4112 E: adam.king(a)auda.org.au | W:www.auda.org.au Twitter: @auda | Blog: www.auda.org.au/blog/ auDA - Australia's Domain Name Administrator Important Notice This email may contain information which is confidential and/or subject to legal privilege, and is intended for the use of the named addressee only. If you are not the intended recipient, you must not use, disclose or copy any part of this email. If you have received this email by mistake, please notify the sender and delete this message immediately.

2 1

Re: arin representation
by Larry Sheldon 25 Mar '14

25 Mar '14

On 3/25/2014 11:53 AM, Bob Evans wrote: > I like term limits for every governing body - except when it's a company I > built with my money. :-) I have absolutely no business jumping into this discussion, but it keeps hammering on a topic that interests me in other venues: "term limits". I am opposed to them, assuming that the election process is open and honest and the voters have an opportunity to be informed. (And if it is not, THAT is what needs to be fixed.) It is my opinion that every discussion of the "need" for term limits involves a person or group of people who have these important characteristics: They propose and vote in favor of legislation or do something else the term-limiters don't like. Their constituency DOES like what they do and signal that by re-electing them. State Senator Ernie Chambers here in Nebraska should be the text-book example of the evils of term limits. -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

How robust is the V6 to V4 infrastructure?
by Naslund, Steve 25 Mar '14

25 Mar '14

A question came to mind with all the discussion of ipv6 vulnerabilities. I am wondering for those with a lot of real world pure IPv6 connectivity, how robust have been the V6 to V4 gateways necessary for intercommunication between native IPv6 hosts and the IPv4 world? I was thinking that going to native ipv6 depends heavily on these gateways being reachable and having fairly high performance characteristics. How are the service providers doing providing these services? Steven Naslund Chicago IL

1 0

Anyone from megapth networks?
by Lou Katz 25 Mar '14

25 Mar '14

Please contact me offlist about an NTP attack. -- -=[L]=- Composed on an ASR33 Linux? Is that an OS, like Pentium?

1 0

ms word
by Randy Bush 25 Mar '14

25 Mar '14

this would be a good time to tll your users not to send or open ms word documents. active 0day http://arstechnica.com/security/2014/03/zero-day-vulnerability-in-microsoft… randy

2 1