March 2015 - Test - lists.nanog.org

Cisco Security Advisory: Cisco IOS Software and IOS XE Software mDNS Gateway Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 25 Mar '15

25 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco IOS Software and IOS XE Software mDNS Gateway Denial of Service Vulnerability Advisory ID: cisco-sa-20150325-mdns Revision 1.0 For Public Release 2015 March 25 16:00 UTC (GMT) Summary ======= A vulnerability in the multicast DNS (mDNS) gateway function of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to reload the vulnerable device. The vulnerability is due to improper validation of mDNS packets. An attacker could exploit this vulnerability by sending malformed IP version 4 (IPv4) or IP version 6 (IPv6) packets on UDP port 5353. An exploit could allow the attacker to cause a denial of service (DoS) condition. Cisco has released free software updates that address this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The March 25, 2015, Cisco IOS & XE Software Security Advisory bundled publication includes seven Cisco Security Advisories. The advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS & XE Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar15.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJVEg3FAAoJEIpI1I6i1Mx3h30P/3gJw08jXsXrVu8KO7L3kqLR vKTMc5BYxLQPoLO3SjI2p6uNKn5iMM6oOsKSZt+mehlDZUUe1JBVricFa07bNQmh jW9mCwVrsMMfOF7NL47vJm6GtGZurhc5WlCRp0uE1PNJs6NmMyRgszTxDz1F5Tjh fq6/2SiKnZW0w+MuxZnrck9rPZ+fzjcpe7sKOUr3htAi/Z0cfhadQrEcVXFuRhn9 bSk0D71zzfXt1VazqOIZiciRJOu/cEN5Tq+NZWTUKqFPFlepjT1G/Ho3WPtQWxbp UwZyeh2InlFnc7DWuNCqW+eZ1CFDPWVNGmWcQq3oxNHkvAAvQsn7vsOgNJRr+yNi S8emKrm94iyIaD2ouOMDgof4MireHLNKNnVecsnuJqUui89zZiT6ZIXg5S8eM5sx rkkfoGjTALePenydwM7eAPjUxI4vFzGPwk1ikQrT49a8fZTJ0/p/S6X8BbybJJXK JHiBdOw88ppa7ixOHgSubHH86KKqm5tCqRI13RpTTtDXQpv4Ev0spiDGeTTKtWEA lGmZldoLHO5Tkk+HUwlUMobluwnt1kGKkAFA+wSRukArAt8i52OUziDmQ4WYBf7a CKw+f6WU9YjGxP2jpp/Xy3u9kKkHHXb8R9y009yXLg1ShZS8eiqQhh6O7O7NuiNL k43tGb1gB+D+0SPS3w/x =DuB0 -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software and IOS XE Software TCP Packet Memory Leak Vulnerability
by Cisco Systems Product Security Incident Response Team 25 Mar '15

25 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco IOS Software and IOS XE Software TCP Packet Memory Leak Vulnerability Advisory ID: cisco-sa-20150325-tcpleak Revision 1.0 For Public Release 2015 March 25 16:00 UTC (GMT) Summary ======= A vulnerability in the TCP input module of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak and eventual reload of the affected device. The vulnerability is due to improper handling of certain crafted packet sequences used in establishing a TCP three-way handshake. An attacker could exploit this vulnerability by sending a crafted sequence of TCP packets while establishing a three-way handshake. A successful exploit could allow the attacker to cause a memory leak and eventual reload of the affected device. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The March 25, 2015, Cisco IOS & XE Software Security Advisory bundled publication includes seven Cisco Security Advisories. The advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS & XE Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar15.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJVEg3FAAoJEIpI1I6i1Mx3s7EP/35lG2sxSOAqj5WWow1L0VbB eCYn6sQTavKyg5pXtFKUyUfF8AUHPrySGpcjy77+s+4uDNswIAXplYQrr8r8OifE xJ8OzuvCXOgvyQEAc8H6l7zLLYOkBv6cFAyYPepl0tPac15iOqX6Xv8l2+gnvi6p puKJYc/81bYmqeE0qRvPDzT9rWiccp1pbWUqUu1ZX31zJ86e/mERHFWOTOBA/qC3 Xd/36ljl4sTR8IPOE7Zoq8jfedlc9Bg3cz7aBrFgx8M9jB/V47MPe6eyfLKHHAEI oXPUu8uJBQsrnYa9/MbN3/wmI9weq3mGhaaStmV9JL0oYn/4gsgY+r4f9euXDMqW b/kIkHxtYHrShckox708oHCjCCTdKiTJcGy+GgTagq49c+A7UCzc8XEwgCOyFFbL 5E2AZ6PJUyUEfbPWhPlCj9H/t3G8mfcmH/FZLpwbEGTtfBCb5b1WRdXd0ARqJqD3 ZXy7M9gKGlifenvs9s9rElO+GuIVvmaAZ2anHgH7aLXCxoc7mIQfTxcjV9whXfD2 TBwHhsR7FMrgtqWbBokq/aNrs/ull9RXsubVFLSToj1BAuJlZpyvjbzQw10bPm5b ZL80JvOffzmf2711jIJCoOiVHGdO/jvb518JMY4XoPyBBKSxtTYpKdKXfBQjQgIv L3q5mEH18S0YiHC8yQAz =W7nK -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software Virtual Routing and Forwarding ICMP Queue Wedge Vulnerability
by Cisco Systems Product Security Incident Response Team 25 Mar '15

25 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco IOS Software Virtual Routing and Forwarding ICMP Queue Wedge Vulnerability Advisory ID: cisco-sa-20150325-wedge Revision 1.0 For Public Release 2015 March 25 16:00 UTC (GMT) Summary ======= A vulnerability within the virtual routing and forwarding (VRF) subsystem of Cisco IOS software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to a failure to properly process malicious ICMP version 4 (ICMPv4) messages received on a VRF-enabled interface. An attacker could exploit this vulnerability by submitting ICMPv4 messages designed to trigger the vulnerability on an affected device. When the ICMPv4 messages are processed, the packet queue of the affected interface may not be cleared, leading to a queue wedge. When a wedge occurs, the affected device will stop processing any additional packets received on the wedged interface. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The March 25, 2015, Cisco IOS & XE Software Security Advisory bundled publication includes seven Cisco Security Advisories. The advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS & XE Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar15.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJVEg3FAAoJEIpI1I6i1Mx3DKAQAKh0z1Us2roV3ahSr8fiIDVW /veWzUDTFiGdlGS4xWExyHL92srs+DoT3wRDwX1UqvmkdRUTfQPGIQl1LAyWujMA TkP6xhTBRTYVtQVQVb4Ubya966QlykNs4jEcmlcep/mGWddLDfF0cOpqDAREAc+Y A8FBn946o3m1Ds/zTkRtvuwc2MOEOglZS6A7fc0a/iDCsnD/FaBlaxHjukgt6xbY OShTjGzJZ7IMsbBizCvlVRYiogCED3EGJ4unM+LvjMRSX2JOu1t5CUJmcXmWIP3u KDQQRB/flmhIUkcaBOMxn4FdBc6ISVLRGPLFSyYJBxz3YE05JqER9QPdK+c2wjKl uyVjCa9Iljuxoqn4TYYFR1X5Gxzt3YZgNJIhy6DTZP6O0OI4U4OaJsiBNDrs3ZMo C9Khl63TlzPG0NfbKXaiPc/2ZakUqty1sKkrFagQ1NcyyzRMJL13uhRIm6G8PPhB Kh1K2GBqGuligoHLVSC0r2NR015iTNobmV+54RCb0RuU+LKl2XFQKYWc3UmNRuQG 36Kf5cZT0gJrF4rryaeCfaSA/LkQsBxEUaMci/APLSR/+qGADTR7EHfIW5kkFlZ7 t/Xi7LON6q3KVBavi3Lo1P+wYV9iNHqy1aeRzAGdC4+FKe0rCdU5cgMZrO1Oc+r6 POD7hEJjIhAb4hRZTjqN =qckG -----END PGP SIGNATURE-----

1 0

Re: Last-call DoS/DoS Attack BCOP
by Scott Weeks 25 Mar '15

25 Mar '15

------------------------------ > measures". I volunteer to write the article on "YOLO upgrades", > wherein one loads untested software on equipment with no OOB, types > "request system reboot", shouts "YOLO", and hits return. :: YOLO ----------------------------- If a manager forces me to do this is it a requirement that I have to yell yolo? ;-) One day I'm going to write that into the test plan. I absolutely hate it when they do that... scott

2 1

FCC to recharter CSRIC for a Fifth Two-Year Term; Seeks Nominations By March 31, 2015 For Membership
by John Curran 25 Mar '15

25 Mar '15

<http://www.fcc.gov/document/fcc-seeks-nominations-csric-v-march-31st> "The Federal Communications Commission (FCC or Commission) is seeking nominations and expressions of interest for membership on the fifth Communications Security, Reliability, and Interoperability Council (CSRIC or Council), which is expected to commence in March 2015 when the current CSRIC charter expires on March 18, 2015. The Council is a federal advisory committee chartered pursuant to the Federal Advisory Committee Act1 that provides guidance, expertise, and recommendations to the Commission to improve the security, reliability, and interoperability of the nation’s communications systems. Nominations and expressions of interest for membership must be submitted to the FCC no later than March 31, 2015. …” The recommendations of any CSRIC activities takes on additional significance in light of the recent FCC reclassification of Internet providers under title II authority. Additional information on CSRIC IV, recent activities, reports, etc. is available here: http://www.fcc.gov/encyclopedia/communications-security-reliability-and-int… FYI, /John John Curran President and CEO ARIN

1 0

AT&T BGP Operations in Miami, FL
by Patrick Tracanelli 24 Mar '15

24 Mar '15

Hello, Is there anyone from ATT BGP operations who can contact-me off list please for Miami location? I have an open ticket since early morning and a BGP session not exporting other transit ASNs, which were just working by the morning. Thank you. -- Patrick Tracanelli

1 0

SFP Programmers
by Mike Hammett 23 Mar '15

23 Mar '15

Where are you guys picking up your SFP programmers? Also, is there a listing anywhere of the vendor codes needed? ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com

5 5

Getting hit hard by CHINANET
by Terrance Devor 23 Mar '15

23 Mar '15

Hello Everyone, I really hope this is not against group policy etc.. however our network is being hit hard by a China IP for the past 6 months. Our systems our up to date, passwordless ssh etc.. but they're DOS attempts are getting more and more aggressive. Tried to contact their phone number to no success (not valid). Emails don't get any response. The IP is 218.77.79.43. Do we have any options? Terrance

13 27

HOSTUS Contact Atlanta DC issues
by Robert Webb 23 Mar '15

23 Mar '15

Apologies for the noise. Looking for information about Hostus issues in Atlanta. I have two servers that are not accessible, one fails login from the VPS Control Panel. Have had high priority ticket in for over an hour with no response and nothing on the network status as far as any issues. Please contact off list.

1 0

(network)technologies used by NSA for data collection
by Martin T 23 Mar '15

23 Mar '15

Hi, I watched "Citizenfour"(imdb.com/title/tt4044364/) documentary and at 41:12 Edward Snowden gives a brief overview of some of the leaked documents to journalists Glenn Greenwald and Ewen MacAskill. At 42:57 Snowden mentions devices which are able to collect data at rate of 1Tbps. This was in 2011. Screen-shots from the movie can be seen here: https://nsa.gov1.info/dni/2014/tumult.jpg Third slide looks like some sort of vendor product roadmap :) Just out of curiosity, what kind of equipment those might be? Is it realistic that NSA/DoD are able to produce their own hardware? Let alone custom silicon like Cisco or Juniper are. Or do they use off the self hardware.. In addition, it's relatively easy to install a passive fiber optical tap for a submarine cable, but how do you get information out of it? I mean all the different wavelengths(CWDM/DWDM) within the same cable, line rates(up to 100GigE), circuit switched and packet switched technologies which those devices should support.. In addition, how(bandwidth and network wise) to transport this data to data analysis and storage equipment if it collected far away from USA.. Some of those questions or thoughts might be naive and stupid, but that's what crossed my mind when I watched the documentary. Maybe somebody, who has done more research in this field, could clarify. thanks, Martin

4 5