- Test - lists.nanog.org

Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 24 Sep '14

24 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability Advisory ID: cisco-sa-20140924-sip Revision 1.0 For Public Release 2014 September 24 16:00 UTC (GMT) Summary +====== A vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device. To exploit this vulnerability, affected devices must be configured to process SIP messages. Cisco has released free software updates that address this vulnerability. There are no workarounds for devices that must run SIP; however, mitigations are available to limit exposure to this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 24, 2014, Cisco IOS Software Security Advisory bundled publication includes six Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep14.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJUIZNgAAoJEIpI1I6i1Mx307EQAI1LtZYk5Eiw9CR6ZQSCPjjI vxWM5f+29TObzPyYSlWuoexDnryZ5s3FZNje6HKz0ie9hoHEXJq1YTU7Ya/JeuWV 6yNgBgbIC94PcpmK+aHuboSk/oe9aEvAsIM5lIQJwTxIa1CTq5zP1iKwe420iOQd YOHy8rjxRXda+G3OS/91m98mLQ72vIwQ2tCqrAsn484RoPMHndnMvchLLwxdEsHL fHW0tdTDXZ0KAup92koXBiIBbasfdOo/EgunmI1xw1bbDqs3fX2G6Dl5SiOUHSM0 0sn83/7WnexbXXG+Zv9vAxgYbevesQWqOpZl0Aw+nl+ov2RvmcuaEKXIm/1yPROV vJXaL+q38c+A34Hio308V8xgnPn1CCW91TrOzT+iv+tIrH6O+jT/ehjz8ioNHrKn lxenUBdRiSvLNF/LOpZFlvRs9Gdbat7iwOLbi7ri5s3Mjs4gRQcPg/ElboFvMz1D bZuSk2y7tq46MxvZosHY1JWu+5VgsO2tJAvl+isgn/Vc6Rk6ZAFpvLK+HjPN7AF3 +rPXMm/lqC9IhgviyNpDEVo0clm9a8vNwgki30s4XCS6Mat4irSX+Af0X6fZ1VII K0M+fNHgR72lLv1NR9TsRWz40njwx+ks9a9fdmkfNRuXXjx8OBfC0kwVKBU0H3EJ hzkjmy3Hee100G2V/9X+ =X1lR -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software DHCP Version 6 Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 24 Sep '14

24 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco IOS Software DHCP Version 6 Denial of Service Vulnerability Advisory ID: cisco-sa-20140924-dhcpv6 Revision 1.0 For Public Release 2014 September 24 16:00 UTC (GMT) Summary +====== A vulnerability in the DHCP version 6 (DHCPv6) server implementation of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper parsing of malformed DHCPv6 packets. An attacker could exploit this vulnerability by sending malformed DHCPv6 packets to be processed by an affected device. An exploit could allow the attacker to cause a memory leak and eventual reload of an affected device. Cisco has released free software updates that address this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 24, 2014, Cisco IOS Software Security Advisory bundled publication includes six Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep14.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJUIZNeAAoJEIpI1I6i1Mx3FxAP/i8bB96s06HvbR5sSFBf6iqW QMfKKOujTGf9w9UH/CUqVtvX2kDLoaZXxoARruZ3hIk2tWqfkFCIyGtCSEXwQxfg +ueE/LpmXZWkvZ7eLk7GS7lclfVlbu4W5GR1+asp3qIOeKRUpY9SPWDlLuT7vmtb s8WmVbDKQOEg3MJSt4tkUSDQsL6AOvhFue2VYjGUnzYX0SPOQxkeCGCbOcmCRGPH 3Yi0IPiUa/XOxOCfsSlXJQP5OWVOlCnQZGiOlyaiaYiyTjUlB7uKgZP/jGIuc/gf 4dt0FTK/VykqLXIXERNBL28IO/4ZZDtkZvosy92iUG/BlXzdxB4+9pZ3wgqeih9Q 2hVNgX+xQ+M6BoTyMZ11OvZxqvaIr4e4ijx/CRx+jkqsX3tgoWzcEWe6EDpAL/6s G7+0cZ04L5zdbZg0NTqciuN04Wm7HEKTpCr3Da/BwomP7Wzx/zHkKAi0IUj/Qa9f hD/RYmapejks3QXpVPaxYoSQANq7u7dBlSenNYxKaurRNDe9JO8y0LHrLWgF/PlW CRRt3k7x5bo+nHSUQrZTIeJhPLcvZ9zxLhs1X3ksSdB44ro0pH9kGky6ewPzrd/7 8HimC+ibFB5bU+sjw1iLNZY3Wd9pVNpiezuCzoKgK4mJ8IjbtFm+mBRvDL4bf5xA oKMD5Aa57OYRgeRzm5ZR =N1Wn -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Multiple Vulnerabilities in Cisco IOS Software Multicast Domain Name System
by Cisco Systems Product Security Incident Response Team 24 Sep '14

24 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Multiple Vulnerabilities in Cisco IOS Software Multicast Domain Name System Advisory ID: cisco-sa-20140924-mdns Revision 1.0 For Public Release 2014 September 24 16:00 UTC (GMT) Summary +====== The Cisco IOS Software implementation of the multicast Domain Name System (mDNS) feature contains the following vulnerabilities when processing mDNS packets that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition: Cisco IOS Software mDNS Gateway Memory Leak Vulnerability Cisco IOS Software mDNS Gateway Denial of Service Vulnerability Cisco has released free software updates that address these vulnerabilities. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 24, 2014, Cisco IOS Software Security Advisory bundled publication includes six Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep14.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJUIZNeAAoJEIpI1I6i1Mx3euMP/0ptD3acwXkieo5NTQEYXU2L cMlnxkTZnXzzjkGAcy0eJKhHAh9JI0FU5DcEVmMbTd7qXnm2sixFYR27dxMCJBaG Quj5RgGGz2KUFNGO87+JX8zw8yBKyknN8eO7njBb6c99UHAv/GVZAjnwcDEbRM3L G7/C7S7ZVkk8w63U46CsVV5eaGj2RQnbZx3jYNhPKjZnCc/MQSM87nnTuR8RjkCm wlrReK6BjxtJ13R3o2NmWzSJWSsc8N81pvIooJdaBCqlGZ4e/j06Z5+S5CF3DGiJ xJvEdKGdvLRo14hUtQLJ8Vx8bJMkHBdr7Bernmca/8AIeXEMdc61ZGs8bS72Magh JbiJIT7B3jQXdjzQpQ/mHKNoghkI302g3H6egrtsCBWr+lepEIfmHLf4h0LueqWh pVQPqXWAGg+5AR1ABvP+mwtQuz/psboXpacMM8keZ2a/6uS82tf3lTXR/8zBd+Om sGbhBYIkO67Cp/Zn2CNY1v9Pg8f4tNAkATazg2Mvt4QfOlRUFRYBdyV2LZLSDCJ4 9/Pw8s7pLMMFpt90pBzIBUY+FsiGkWoHduMO7/O93Zw4Y2n2vnRYFkyuFQFphBuO M2Yb20vqO9tsELTt0MDmdfXf40HhhAUF6zbw6fWa4SCV4CwZn6h8eAZttsqQQqxl cdgZjAsAV5dsoejxk0LC =7Kkh -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software Metadata Vulnerabilities
by Cisco Systems Product Security Incident Response Team 24 Sep '14

24 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco IOS Software Metadata Vulnerabilities Advisory ID: cisco-sa-20140924-metadata Revision 1.0 For Public Release 2014 September 24 16:00 UTC (GMT) Summary +====== Two vulnerabilities in the metadata flow feature of Cisco IOS Software could allow an unauthenticated, remote attacker to reload a vulnerable device. The vulnerabilities are due to improper handling of transit RSVP packets that need to be processed by the metadata infrastructure. An attacker could exploit these vulnerabilities by sending malformed RSVP packets to an affected device. A successful exploit could allow the attacker to cause an extended denial of service (DoS) condition. Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are not available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 24, 2014, Cisco IOS Software Security Advisory bundled publication includes six Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep14.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJUIZNfAAoJEIpI1I6i1Mx3SpwP/jfNLKisT8kvgV2iMhFr0Z2w 1oOqnYmG1WWNh/yXh+uKIPeHUDSYjsW1ntAP/vnuw1Op2UDPMl1fTWe4AWo8huOf R2cq3dCBZRfKmlhfJAGuqaramkAITwLPNsODwIHZUwXYQPrHnlZB7c/Ry8dkE+d5 ATGeGFS9nDnboAKyRFyusLarQ95X+Yukpq/BmGLXd+neuC+tz4x1PCBvQJdeqaMx Fg2r94dg0mhzwYJ/HBLVUk4OJRYhJxUeJw7zqrB9GGZnYry+ll8qY9pSbMVpI1Yy 523Okpes5zJ1KNR+uceABj1SSpe0n+LAfqj8ekkzrZz7CQGONYEd39PSor73zKBE 1SmyUVj75hoH3rx45SQLgArvfUXkJZLeSgnstWU7DCIlD5OjxMbazq8nlU9cmD5q gXKtPLZI8/xREwUjmmowv3ykSscxW7x0EBL/NCG+JcXmTGS26gf8SGsVfkDYIkuo iLxrgkiuvXtq+SGLdmRnfC7Ts2m/5E1AJHW7V64yZ+tNLW4XM5cMjMtDZXTQdQHN sQvPe8E4sFFpcSn2vi0Y5weBItr3p+QGDF5HxojPr1NLZz8bHUBWJ6kjYvDynM3C yGXTgEI7g8vmzcfeBTZCa3Us/qDb+0DZFzt15TpUbZmcuVjcoSo3myp1+XzP7ky2 xC9OlRnpvnRWrSnAXcLe =E9az -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software RSVP Vulnerability
by Cisco Systems Product Security Incident Response Team 24 Sep '14

24 Sep '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco IOS Software RSVP Vulnerability Advisory ID: cisco-sa-20140924-rsvp Revision 1.0 For Public Release 2014 September 24 16:00 UTC (GMT) Summary +====== A vulnerability in the implementation of the Resource Reservation Protocol (RSVP) in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker cause the device to reload. This vulnerability could be exploited repeatedly to cause an extended denial of service (DoS) condition. Cisco has released free software updates that address this vulnerability. A workaround that mitigates this vulnerability is available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The September 24, 2014, Cisco IOS Software Security Advisory bundled publication includes six Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep14.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJUIZNfAAoJEIpI1I6i1Mx3qoIP/RnDEwuhG4SEtyEAycEOpJoX cDsmK8C0xRKYkoUeSlmkO1TXzRk42RMnd6aoYAxojgqsYnVt10ZKibSLzCxZxWnX MMKhMPSrUSvWvPNgLDYyOJ4R4B6IOwYwS6wNCABtiwes/rET+p+d0gw4rZ4SLujF hSrWcxE8Fax5zU7Z++ZifOhcg/C7gGvIbsuStf01S6/oZHPx8PXnVj9J4eI0Yxz9 JRhkJQv8FlfJYzZnxbi545YH1fUt+e5FzTTlPOaYayYqi0E/NvrPW64s8QKLURE7 M01EzxIsyItwxIYAXy5pcUHnyAd/bZ21CmEiHvOq4GZVXoZpkkF0pCceos+mC987 4mPYVe+PwNrPJwb0qdG6MKDiXmO+txVFLazNF2JJaGeFYjeN+If57mJSttznVLiE ZPCkdLmr/Y2uDbtwoDdFI6TbrIsFceawIEKLn5lIPQrtt+JiwkWkxKSLMsB6wm0l nmogpIL43jgnozrYRTMizA+hu/mHgg88mOWD/AAFA5O6K+YQIEYYtYjy4Bundrq7 2Rr6uJNUN9fD3amT3ZqP6DE7ETlAkC29sFy0IuXkudpXc+YrcVAkhwrlMekoeepL t6cWl+o8dTaexJe7h4neuADwCPrT15wNBiasHP0Uw/BAUnbPM2aOjL8WZDb1BHvT 5AkSuOMpsSZakqt0vik+ =kL1E -----END PGP SIGNATURE-----

1 0

Google Services Problems?
by Jason Lester 24 Sep '14

24 Sep '14

Is anyone else seeing intermittently down or very slow access to Google services like YouTube and Google Play Store? We have two upstream providers: one peers with XO and Level3, one with Qwest. When our Google traffic is preferring the route through XO, we see things like YouTube videos not loading, Android devices not able to download updates, Google Play Music not streaming, etc. The main source network we are seeing it from is 206.111.9.XXX which is owned by XO according to whois, but seems to be sourcing Google traffic. I assume they are caching or CDN servers of some type for Google that are hosted at XO. The problem started on Friday as far as we can tell. We had a similar problem a few weeks ago with Google Images searching. The search result page showed the same thumbnail (a car crash) for anything you searched for. It was again being sourced from the 206.111.9.XXX network. Clicking on the image showed you the proper image, just the thumbnails were wrong. It cleared up in a couple of hours in that case, but the current problem has been going on for a while. Thanks, Jason

1 0

IPV6 Multicast Listener storm control?
by Richard Holbo 23 Sep '14

23 Sep '14

(originally posted to wispa ipv6 list, and someone there mentioned that folks here might have some suggestions, so apologize if you are a member of both.) I am seeing issues with IPV6 multicast storms in my network that are fairly low volume (1-2mbit), but that are causing service disruptions due to CPU load on the switches and that the network is a Point to MultiPoint wireless network. I have about 500 IPV4 clients on a vlan served by Cisco ME3400, Catalyst 3750 and 3560 switches. These are switched back to a routed interface and IP addresses are assigned by DHCP. We are not using IPV6 at all, and I don't have control of the clients. What I'm seeing is IPV6 Multicast Listener requests from a single client (different clients at different times) going out on the network, the switches manage them in software, so CPU goes up (not a lot, but it seems to impact performance quite a bit), but the larger problem is that all other IPV6 clients respond to the multicast broadcast address generating a 1-2mbit storm of traffic to all ports all the time. This then transits the bandwidth constrained wireless network in a steady state, causing high collisions which causes _significant_ performance degradation in the wireless network. It would appear that this is _generally_ caused by Dell or HP workstations with buggy network interface cards in hibernate mode. http://blog.bimajority.org/2014/09/05/the-network-nightmare-that-ate-my-wee… http://packetpushers.net/good-nics-bad-things-blast-ipv6-multicast-listener… Now it looks like from my reading that CISCO MLD snooping would _help_ with this, though it would not stop the offender from generating the multicast requests, it might keep if from reaching _all_ ports, but it would still affect any ports that had _subscribed_ IPV6 clients, and it would require changing the SDM template and a reload on all the switches. So not a real answer and very painful. Right now, I'm just tracking the source down and shutting it off. Do not really want to get into an argument about switched vs routed, and am working on reducing the size of the broadcast domain now, but this is a new issue, and I need to come up with some kind of plan to resolve with my current equipment/network. Any thoughts?? Ideas? I suspect this will become more of an issue for more folks in the near future. /thanks -- Richard Holbo Southern Oregon Network Support Services richard.holbo(a)sonss.net - 541.890.8067 http://www.sonss.net

4 4

Re: Saying goodnight to my GSR
by Larry Sheldon 22 Sep '14

22 Sep '14

On 9/22/2014 08:35, David Hubbard wrote: > Got you beat by nine weeks with a Foundry 9604. :-) > The system uptime is 3411 days 7 hours 52 minutes 20 seconds > The system started at 01:38:44 Eastern Sat May 21 2005 That's the kind of waving I like to see. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

1 0

Re: Saying goodnight to my GSR
by Larry Sheldon 22 Sep '14

22 Sep '14

On 9/22/2014 06:38, Alain Hebert wrote: > Properly configured, it is less a security issue than newer devices. > > Pretty impressive from Matthew to have the patience/skills to not > simply "reload" that fridge over the years. Whew! I was afraid I was the one who thought so anymore. -- The unique Characteristics of System Administrators: The fact that they are infallible; and, The fact that they learn from their mistakes. Quis custodiet ipsos custodes

1 0

Saying goodnight to my GSR
by Matthew Crocker 22 Sep '14

22 Sep '14

Has been running for a while, time to shut ‘er down. She (is a router a she?) used to handle all of my BGP GigE links but over the years has been demoted to OSPF and T1 aggregation. If anyone needs a boat anchor let me know. gsr8-1#show version Cisco Internetwork Operating System Software IOS (tm) GS Software (GSR-P-M), Version 12.0(30)S3, RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2005 by cisco Systems, Inc. Compiled Thu 30-Jun-05 18:29 by pwade Image text-base: 0x50010E80, data-base: 0x536E8000 ROM: System Bootstrap, Version 11.2(20030108:132517) [jkuzma-112 2.2] RELEASE SOFTWARE gsr8-1 uptime is 9 years, 9 weeks, 2 days, 8 hours, 39 minutes Uptime for this control processor is 9 years, 2 weeks, 2 days, 18 minutes System returned to ROM by Stateful Switchover at 13:46:36 UTC Tue Sep 6 2005 System image file is "slot0:gsr-p-mz.120-30.S3.bin" cisco 12008/GRP (R5000) processor (revision 0x05) with 524288K bytes of memory. R5000 CPU at 200Mhz, Implementation 35, Rev 2.1, 512KB L2 Cache Last reset from power-on 2 Route Processor Cards 2 Clock Scheduler Cards 3 Switch Fabric Cards 2 Single Port Gigabit Ethernet/IEEE 802.3z controllers (2 GigabitEthernet). 1 Three Port Gigabit Ethernet/IEEE 802.3z controller (3 GigabitEthernet). 1 Ethernet/IEEE 802.3 interface(s) 5 GigabitEthernet/IEEE 802.3 interface(s) 507K bytes of non-volatile configuration memory. 20480K bytes of Flash PCMCIA card at slot 0 (Sector size 128K). 8192K bytes of Flash internal SIMM (Sector size 256K). Configuration register is 0x2102 -- Matthew S. Crocker President Crocker Communications, Inc. PO BOX 710 Greenfield, MA 01302-0710 E: matthew(a)crocker.com P: (413) 746-2760 F: (413) 746-3704 W: http://www.crocker.com

19 22