- Test - lists.nanog.org

Heads-Up! (INFO#95.16723)
by Thomas Longstaff 29 Jun '95

29 Jun '95

-----BEGIN PGP SIGNED MESSAGE----- Content-Type: text/plain; charset=us-ascii ============================================================================= Heads-Up to Network Service Providers - IP Spoofing Attacks CERT Coordination Center June 29, 1995 ============================================================================== Over the past few weeks, we have received reports of 170 IP spoofing attacks against Internet sites internationally. We are sending you this "heads-up" because you are a likely target. At least 80 of the targets we know of are name servers, routers, and other network operation systems. The attacks have been largely successful, we continue to receive reports, and we are concerned that more attacks are going undetected. We urge you to check your systems and routers for any signs of compromise and to use the information in CERT advisory CA-95:01, "IP Spoofing Attacks and Hijacked Terminal Connections," to help protect yourself, detect IP spoofing attacks, and recover from root compromises. The advisory is available by anonymous FTP from ftp://info.cert.org/pub/cert_advisories This "heads-up" contains additional information about what you can do, as well as issues to consider before taking action. Please feel free to forward this to other providers of Internet services. Communicating with us - ---------------------- Warning: For sensitive information, use encrypted email. You will find the CERT public PGP key at the end of this document. We would appreciate it if you would let us know whether you are watching for IP spoofed packets on your networks (or plan to do so). If you see spoofed packets, we'd like to learn how many you see and from how many different sites; this will help us determine the scope and pattern of the attacks. We will keep all detailed information and the identity of organizations confidential. Because of our workload, we must ask you not to send log files of activity, but we would be happy to work with you as needed on how to interpret data that you may collect. If you see activity that indicates an attack is in progress, we encourage you to contact your customer, or other involved sites or their service provider. We have some general information on IP spoofing and on recovering from a compromise that we can make available to you for your customers' use. We would also be happy to provide guidance and advice, if needed, on how to handle incidents and work with law enforcement. ............................................................................. Some things you can do - ---------------------- It is possible to check network traffic for indications of the type of attack we are currently seeing. Before doing so, please look at the next section, "Issues to consider before taking action." There are several classes of packets that you could watch for. The most basic is any TCP packet where the network portion (Class A, B, or C or a prefix and length as specified by CIDR, the Classless Inter-Domain Routing specification) of the source and destination addresses are the same but neither are from your local network. These packets would not normally go outside the source network unless there is a routing problem, worthy of additional investigation, or the packets actually originated outside your network. The latter may occur with Mobile IP testing, but an attacker spoofing the source address is a more likely cause. For a NAP or NSP, the interface into which a packet arrived indicates the direction of the source of the attack. The packet's destination address indicates the "trusted" host involved in an attack. That information suggests which hosts may be under attack. There are public domain and vendor provided tools available for checking your networks for IP spoofed packets. Among them are Argus, tcpdump, and snoop. Argus 1.5 - --------- Argus is an IP network transaction-auditing tool developed at the Software Engineering Institute of Carnegie Mellon University. The Argus 1.5 distribution includes scripts that perform simple network administrative tasks, one of which is IP spoofing detection. The data that Argus generates makes it possible to analyze network activity and performance in ways that have not been possible before. For example, you can answer questions such as, "Were there any IP spoofing attempts into our firewall network over the past 8 hours?" The developers of Argus have made the tools available from ftp://ftp.sei.cmu.edu/pub/argus-1.5 If you have any questions, comments, or suggestions, please send mail to argus(a)sei.cmu.edu. Scripts - ------- At the end of this document ("Attachment A") are scripts you may want to use to check your network. We are aware that the Internet is now "classless," meaning that the old notion of class A, B, and C addresses is being replaced with a prefix and length notation, also known as CIDR. Even so, the scripts, which are based on classes, may be useful to some service providers. In all the IP spoofing incidents reported to us to date, we believe that the scripts would have shown the spoofed packets. (The problem here is that these scripts may either show other packets labeled as spoofed or not show true spoofed packets due to CIDR.) A standalone machine running tcpdump or equivalent should be able to run these scripts without affecting the performance of the local net. It may be possible to configure routers to do this check directly but we are not currently aware of any systems on which this is possible. .............................................................................. Issues to consider before taking action - --------------------------------------- Before writing this "heads-up," we consulted colleagues on other response teams, several network service providers, and other technical experts. They raised the following issues, and there surely are others you should consider before taking action. Technical and performance issues: - There may be too many "false positives." Two causes are mobile IP and misconfigurations; there may be other causes as well. - The feasibility of installing network monitors may depend on network topology. - It is not clear how many monitoring machines you would need to pinpoint the problem. - When the tcpdump and snoop scripts were tested on a dedicated Sun IPX connected to a T1, the impact on performance was only marginal. Long-haul tests with similar scripts do not have performance problems either. - Anything above a T1 is going to cause some performance problems (applications like tcpdump and snoop do not work very well at all on DS3 or FDDI interfaces). Legal issues: - - Some service providers believe that checking your network as we suggest is all right; others believe that there may be a problem. We urge you to check with your legal advisors about analyzing packet header information, analyzing traffic content to detect unauthorized activity, and analyzing internal traffic and customer-bound traffic. - - For US service providers, the Digital Telephony Bill of 1994 is relevant; in particular, check the amended provision found at 18 U.S.C. 2511(2) (a) (i), which permits an electronic communications service and its employees to ...intercept, disclose, or use that communication in the normal course of...employment while engaged in any activity which is a necessary incident to the rendition of...service or to the protection of the rights or property of the provider of that service.... .............................................................................. Attachment - Scripts for Checking Networks - -------------------------------------------- We have tested the following scripts on a recent version of tcpdump and snoop (192.9.200.0 would be replaced by the site's local net, of course): --- script for tcpdump --- #!/bin/sh tcpdump 'tcp and not dst net 192.9.200.0 and ( (ip[12]&0x80=0 and ip[12]=ip[16]) or (ip[12]&0xc0=0x80 and ip[12]=ip[16] and ip[13]=ip[17]) or (ip[12]&0xe0=0xc0 and ip[12]=ip[16] and ip[13]=ip[17] and ip[14]=ip[18]) )' (Note this only seems to work with tcpdump-3.0.2 and libpcap-0.0.6 currently.) --- script for snoop --- #!/bin/sh snoop 'tcp and not net 192.9.200.0 and ((ip[12]&0x80=0 and ip[12]=ip[16]) or (ip[12]&0xc0=0x80 and ip[12]=ip[16] and ip[13]=ip[17]) or (ip[12]&0xe0=0xc0 and ip[12]=ip[16] and ip[13]=ip[17] and ip[14]=ip[18]))' (Note that this does not appear to work with Solaris 2.3 machines.) To more accurately analyze network traffic, it is useful to first describe the network topology; for example: ---------------- | INTERNET | ---------------- | ---------- | | NETWORK | ---------------- | MONITOR | | ROUTER | ---------- ---------------- | | | | ----------------------------------------------------------------- |MAC-A |MAC-B |MAC-C --------- --------- --------- |ROUTER | |ROUTER | |ROUTER | --------- --------- --------- | | | | | | | | | | | | | | | | | | | | | | | | | | | Ca Cb Cc Cd Ce Cf Cg Ch Ci (MAC-A, MAC-B, and MAC-C refer to the ethernet addresses of the router interfaces attached to the same network as the network monitor machine.) In this case, the machine used to check network traffic could be any machine capable of running tcpdump, snoop, or any other packet capture and analysis software. This machine could be programmed so that any packets that match the following expression are displayed. tcp and ( not ether src MAC-A and ( src net Ca or src net Cb or src net Cc ) not ether src MAC-B and ( src net Cd or src net Ce or src net Cf ) not ether src MAC-C and ( src net Cg or src net Ch or src net Ci ) ) This expression looks at the source address of each packet and identifies those that did not originate from the correct interface. This example should be extensible to take CIDR into account. For example, if the CIDR specification of network Ca is 192.9.200/21, then the sub-expression: src net Ca should be replaced with: ip[12:4]&0xfffff800=192.9.200.0 .............................................................................. CERT Public Key - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAi2a4WoAAAEEAN0IPkqCmoGRud0Kts3g4ZGgZ4zyqY8C5VTOgUcqU+D2U1so 21K6dxj/lewKFduXtNpqDeg6C0wR6GIMJ2jWLU4GUEq0xHohioWGGg5O3QTvCpN3 rnLIKO9urv4Wjgkp1n1ys7xcOYl5jb7kuhdlXs3kNgKi4zBB5XVP+x0t4w7BAAUR tChDRVJUIENvb3JkaW5hdGlvbiBDZW50ZXIgPGNlcnRAY2VydC5vcmc+iQCVAgUQ LZrkOXVP+x0t4w7BAQEI3QP/d9gl7GD52Pd8KbsBMb0hiploigL8kZW1Q1fVsIm1 cO9xumU89CLf2jrN+IdrIMpVWAO3DyJjZooZTaJBg/9jjv3HltHTq/XFD5c+WYlM G+fQZVuR8qu8+D8P8pPbNVm94wxj9fyKO39/dnub1UfjDedJBtt+zgMJmstADkOv QBM= =N6E5 - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBL/MOmHVP+x0t4w7BAQF7+QQAp8mm5Bnu+/wiQK2trEn1JtzV6Ls3Z/gP 1SgZe85eTEGzKvRPKb+G3W7HAFn56B6X6JCgixl0Xgj/zcYlOvraug16/DfAd6i0 dkZXcrTQn+GRSHbi6oXPs5FRCE0eE5tFkhouVnROECBLoKJOR9/0dE4NuLzCkm3Q Uf+x64RmkIs= =RBqe -----END PGP SIGNATURE-----

1 0

Save Your Computer!
by Britestar＠dub-news-svc-1.compuserve.com 28 Jun '95

28 Jun '95

"Save Your Computer" Surge sentry computer grade with fax/modem. four outlet surge/noise cube with two RJ-11 jacks for fax/modem line and power protection. 3 stage/line circuitry. 1 picosecond clamp response time. Emi/rfi noise rejection to 35db. UL 1449 rating at 330v. 347 joules. Max surge 11,505 amps. Lifetime warranty and power protection. Putty. 2"h x 4"w x 6.5"d. MFG# ds41psg1. Shipping weight 1.721 lbs. Price: $69.95, shipping and handling included. --------------------------------------------------------- "Repair your Computer" Computer tool kit. By Curtis. Can be used to repair maintain and upgrade virtually any microcomputer system. All tools are demagnetized. Lifetime warranty. Zipper vinyl case. Black 6"h x 9"w x 1.37"d. MFG# tk3ctf 20 piece set (l lb). Price $29.95. Shipping and handling included. MFG# tk4ctf 55 piece set (3 lbs). Price $52.99. Shipping and handling included. ----------------------------------------------------- "Super discount" Voice activated telephone recorder. By TT Systems. One button record, pause, fast forward/rewind, volume control, tape counter, cue and review, LED record light, built-in condenser mic for non-phone recording. AC or battery powered. Uses standard cassettes. Black. 1.5"h x 7"w x 4"d. MFG# vtr500tts. Shipping weight 2.28 lbs. Special price $199.95. Shipping and handling included. Save $100 dollars! Send your check or money order to: Britestar Enterprises 3701 Inglewood Ave Suite #304 Redondo Beach, CA 90278 Please list MFG# with your order. Please allow 7 - 10 days for delivery. ------------------------------------------------------- Money Manager Software "MoneyManager," from Times Publishing does virtually everything Quicken does, and even surpasses it in some respects due to a more powerful language it uses. (IBM compatible only). "MoneyManager" for Windows is the software that allows a person to take control of their personal finances by organizing, tracking and reporting income, expenses, assets, liabilities and investments on a daily basis on his PC. "MoneyManager" prints checks, pays bills and reconciles even the most complex bank statement in seconds. "MoneyManager" tracks your checking, savings, credit card and money management. You can record and categorize your expenses, compare them to budgets and know exactly where your money goes. Keep your investment of stocks, bonds and mutual funds portfolio up-to-date with "MoneyManager." Calculate and analyze your gains, losses and returns on investments and tax consequences in an instant. Thinking of buying a home? "MoneyManager" will create a home affordability analysis for you. Lease-or-buy decisions were never easier. Want to pay off that mortgage faster? It will produce amortization schedules and show you the whopping savings in interest you can realize by making small prepayments of principal. How about income statement, balance sheet, cash flow forecasts, and net worth projections? All of these are available at your fingertips with "MoneyManager." Sale price: $24.99 - Shipping and handling included. 7 - 10 days for delivery. Comes in 3 1/2 or 5 1/4 diskettes, (choose one). Send your check or money order to: Britestar Enterprises 3701 Inglewood Ave Suite #304 Redondo Beach, CA 90278 -------------------------------------------------------- Geographics GEO4000 Moving Message Color Sign, from "Geographics" Multi-color: 16 vibrant colors/hues. Displays maximum 27 characters, minimum 14 characters. 3 fonts, 4 text styles, 10 preprogrammed graphics, 46 European characters. "Magic" interface. Network up to 254 signs. 90-day memory backup. Display area: 3"H x 37.6"W. Indoor use only. Includes wireless remote, mounting brackets and adapter. 5.5"H x 39.6"W x 1.4"D. Shipping weight 11 lbs. MFG# 08386EZL. Sale price $370.50, shipping and handling included. --------------------------------------------------- "Fresh Air" "Bionaire" 2 speed personal air purifier/ionizer. Cleans air in a room 10' x 10' x 8' in 12 minutes. 2-speed, low noise, turbo system. 4 stage filtration system. Effective on tobacco smoke, pollen, dust, bacteria. Ion on/off switch. Flame retarded, injection-molded plastic casing. One year limited warranty. Black. 12.5" x 7.5" x 8"d. MFG# f7obio. Price $94.95, shipping and handling included. -------------------------------------------------------- 18 Karat Gold "Cross" 18 Karat Gold Fountain Pen. 18 Karat Gold Fountain Pen available in four 18 Karat nib widths. Piston converter included. Gift boxed. Comes with Lifetime Mechanical Guarantee. Shipping weight 1 lb. MFG# 8036bcro Broad nib MFG# 8036mcro Med. nib MFG# 8036fcro Fine nib MFG# 8036xcro X-fine nib Price $990.64, Shipping and handling included. Save $279.36. Send your check or money order to : Britestar Enterprises 3701 Inglewood Ave Suite #304 Redondo Beach, CA 90278 Please list MFG# with your order. Please allow 7 - 10 days for delivery. --------------------------------------------------------- Snail Mail Order Form Send your check or money order to: Britestar Enterprises 3701 Inglewood Ave Suite #304 Redondo Beach, CA 90278 Name: ________________________________________________________ Address: ______________________________________________________ City/State/Zip:_______________________________________________ Phone: _______________________________________________________ I've enclosed my check or money order for: "MoneyManager" software for Windows. Diskette Size: 3 1/2 ____ 5 1/4 ____ Surge sentry computer grade with fax/modem MFG# ds41psg1 Price 69.95, shipping and handling included. [ ] Computer took kit. By Curtis. MFG# tk3ctf 20 piece set (l lb) Price $29.95, shipping and handling included. [ ] MFG# tk4ctff 55 piece set (3 lbs). Price $199.95, shipping and handling included. [ ] Voice activated telephone recorder. By TT Systems. MFG# vtr500tts shipping weight 2.28 lbs. Special price $199.95. Shipping and handling included. [ ] GEO 4000 Moving Message Color Sign, from :Geographics" MFG# 08386EZL Sale price $370.50, shipping and handling included [ ] "Bionaire" 2 speed personal air purifier/ionizer MFG# f7obio. Price $94.95, shipping and handling included. [ ] "Cross" 18 Karat Gold Fountain Pen MFG# 8036bcro Broad nib [ ] MFG# 8036mcro Med. nib [ ] MFG# 8036fcro Fine nib [ ] MFG# 8036xcro X-fine nib [ ] Price $990.64. Shipping and handling included. "Never leave home to shop" A 544 page catalog, with over 12,356 name brand items, filled with office/electronic products. Names like Sony, Sharp, Magnavox, Panasonic, JVC, Packard Bell, Brother, Cobra, Toshiba, Pioneer, Casio, and over 216 others. Price $8.00, shipping and handling included. [ ] ............................... . BriteStar, Inc. . 3701 Inglewood Ave . Suite 304 . Redondo Beach, CA . 90278 ..................................

1 0

None
by List-Admin Account 23 Jun '95

23 Jun '95

Walter: You are on the nanog list already. Pam Ciesla >From mcd(a)interview.com Tue Jun 20 19:54:19 1995 Received: from merit.edu (merit.edu [35.1.1.42]) by home.merit.edu (8.6.12/merit-2.0) with ESMTP id TAA13814; Tue, 20 Jun 1995 19:54:19 -0400 Received: from interview.com (mcd(a)interview.com [204.192.25.2]) by merit.edu (8.6.12/merit-2.0) with ESMTP id TAA25322 for <nanog-request(a)merit.edu>; Tue, 20 Jun 1995 19:54:16 -0400 Received: (from mcd@localhost) by interview.com (8.6.12/8.6.12) id TAA14718; Tue, 20 Jun 1995 19:55:21 -0400 From: wjl(a)sura.net Date: Tue, 20 Jun 1995 07:19:14 -0400 Message-Id: <199506201119.HAA12744@hico> To: nanog(a)merit.edu ReSent-Date: Tue, 20 Jun 1995 19:55:15 -0400 (EDT) ReSent-From: Mark Christopher Davies <mcd(a)interview.com> ReSent-To: nanog-request(a)merit.edu ReSent-Subject: Resent mail.... ReSent-Message-ID: <Pine.BSD/.3.91.950620195515.11126I(a)interview.com> Status: R wjl Subject:subscribe subscribe wjl(a)sura.net

1 0

None
by wjl＠sura.net 20 Jun '95

20 Jun '95

wjl Subject:subscribe subscribe wjl(a)sura.net

1 0

Free Agent Spam
by free-agent-spam＠spam.com 19 Jun '95

19 Jun '95

Free Agent, Spam Ware Without Compare

1 0

Satellite channels to England, France and Canada
by Emin R. Gabrielian 18 Jun '95

18 Jun '95

Hi Everebody, Lines: 33 Our organization is busy in the field of telecommunication. Our company name is "JSC INFOCOM". We are sertifyed as major operator of Data Transfer Networks in Armenia and licensed with exclusive rights in any kind of data transfer on territory of Armenia by Ministry of Communication of Republic of Armenia. Now we have two 64Kbps rate satellite channels to NewYork and Tyson, based on X.25 protocols, IP and X.25 network infrastructure on territory of Armenia, and several SLIP channels to Internet encapsulated over X.25 network. But the speed of this channels are limited by our SLIP provider's X.25 network speed. So, now we are interested to have direct links with IP providers. We are ready to request additional satellite channels. Our Ministry of Communication is ready to let give us 64Kbps rate channels to England, France and Canada. If there is an organization in this countries, who can provide us in connection with Internet, we shall be ready to collaborate with them. I shall be very glad, to have any information that can help me to fix this problem. Thank You in Advance, Best Regards, Emin Gabrielian. voice: +7 (88539) 06842 fax: +7 (88539) 06852 fax/voice: +7 (8852) 528856 +7 (8852) 151926 e-mail: emin(a)mtd.armenia.su emin(a)hermes.lnf.infn.it X.400: (C:USA,A:TELEMAIL,O:ALLIANCE.PARTNERS,UN:INFOCOM.ADMIN) (C:ARMENIA,A:ARMMAIL,O:MOC,UN:EMIN)

1 0

fyi:
by Pat Smith 16 Jun '95

16 Jun '95

------- Forwarded Message Date: Sun, 11 Jun 1995 15:46:13 -0600 From: "R. S. Ashton" <rashton(a)tag01.acnet.net> To: userhelp(a)merit.edu Subject: NANOG information (fwd) - ---------- Forwarded message ---------- Date: Sun, 11 Jun 1995 15:34:17 -0600 (CST) From: R. S. Ashton <rashton(a)tag.acnet.net> To: info(a)merit.edu Subject: NANOG information Dear Merit: My name is R S Ashton and I am the President of The Ashton Group. One of our holdings Ashton Communications Corporation, is a CIX member and the V.34 and HS Dedicated Internet provider in Mexico (and some US Connections). We are U.S. based. I desire to become involved in NANOG, and cannot find out where to subscribe. Can you provide me with additional information. Also, in the purpose, it requested systems availability. Ashton is willing to make system resources available. Many thanks ------- End of Forwarded Message

1 0

Re: subscribe
by List-Admin Account 15 Jun '95

15 Jun '95

Already on the mail list. Pam Ciesla >From mcd(a)interview.com Fri Jun 9 21:21:34 1995 Received: from merit.edu (merit.edu [35.1.1.42]) by home.merit.edu (8.6.12/merit-2.0) with ESMTP id VAA28776; Fri, 9 Jun 1995 21:21:33 -0400 Received: from interview.com (mcd(a)interview.com [204.192.25.2]) by merit.edu (8.6.12/merit-2.0) with ESMTP id VAA10252 for <nanog-request(a)merit.edu>; Fri, 9 Jun 1995 21:21:29 -0400 Received: (from mcd@localhost) by interview.com (8.6.12/8.6.12) id VAA18289; Fri, 9 Jun 1995 21:21:24 -0400 From: Abir Hnidi <ahnidi(a)Ascend.COM> Message-Id: <9506091929.AA19216(a)spud.Ascend.COM> Subject: subscribe To: nanog(a)merit.edu Date: Fri, 9 Jun 95 12:28:59 PDT Cc: ahnidi(a)Ascend.COM ReSent-Date: Fri, 9 Jun 1995 21:21:14 -0400 (EDT) ReSent-From: Mark Christopher Davies <mcd(a)interview.com> ReSent-To: nanog-request(a)merit.edu ReSent-Message-ID: <Pine.BSD/.3.91.950609212114.10652L(a)interview.com> Status: RO subscribe ahnidi(a)ascend.com

1 0

CERT Vendor-Initiated Bulletin VB-95:04 (Wietse Venema)
by CERT Bulletin 14 Jun '95

14 Jun '95

CERT Vendor-Initiated Bulletin VB-95:04 June 14, 1995 Topic: Logdaemon/FreeBSD vulnerability in S/Key Source: Wietse Venema (wietse(a)wzv.win.tue.nl) To aid in the wide distribution of essential security information, the CERT Coordination Center is forwarding the following information from Wietse Venema, who urges you to act on this information as soon as possible. Please contact Wietse Venema if you have any questions or need further information. ========================FORWARDED TEXT STARTS HERE============================ A vulnerability exists in my own S/Key software enhancements. Since these enhancements are in wide-spread use, a public announcement is appropriate. The vulnerability affects the following products: FreeBSD version 1.1.5.1 FreeBSD version 2.0 logdaemon versions before 4.9 I recommend that users of this software follow the instructions given below in section III. ----------------------------------------------------------------------------- I. Description An obscure oversight was found in software that I derived from the S/Key software from Bellcore (Bell Communications Research). Analysis revealed that my oversight introduces a vulnerability. Note: the vulnerability is not present in the original S/Key software from Bellcore. II. Impact Unauthorized users can gain privileges of other users, possibly including root. The vulnerability can be exploited only by users with a valid account. It cannot be exploited by arbitrary remote users. The vulnerability can affect all FreeBSD 1.1.5.1 and FreeBSD 2.0 implementations and all Logdaemon versions before 4.9. The problem exists only when S/Key logins are supported (which is the default for FreeBSD). Sites with S/Key logins disabled are not vulnerable. III. Solution Logdaemon users: ================ Upgrade to version 4.9 URL ftp://ftp.win.tue.nl/pub/security/logdaemon-4.9.tar.gz. MD5 checksum 3d01ecc63f621f962a0965f13fe57ca6 To plug the hole, build and install the ftpd, rexecd and login programs. If you installed the keysu and skeysh commands, these need to be replaced too. FreeBSD 1.1.5.1 and FreeBSD 2.0 users: ====================================== Retrieve the corrected files that match the system you are running: URL ftp://ftp.cdrom.com/pub/FreeBSD/CERT/libskey-1.1.5.1.tgz MD5 checksum bf3a8e8e10d63da9de550b0332107302 URL ftp://ftp.cdrom.com/pub/FreeBSD/CERT/libskey-2.0.tgz MD5 checksum d58a17f4216c3ee9b9831dbfcff93d29 Unpack the tar archive and follow the instructions in the README file. FreeBSD current users: ====================== Update your /usr/src/lib/libskey sources and rebuild and install libskey (both shared and non-shared versions). The vulnerability has been fixed with FreeBSD 2.0.5. ----------------------------------------------------------------------------- S/KEY is a trademark of Bellcore (Bell Communications Research). Wietse Venema appreciates helpful assistance with the resolution of this vulnerability from CERT/CC; Rodney W. Grimes, FreeBSD Core Team Member; Guido van Rooij, Philips Communication and Processing Services; Walter Belgers. =========================FORWARDED TEXT ENDS HERE============================= CERT bulletins, CERT advisories, information about FIRST representatives, and other information related to computer security are available for anonymous FTP from info.cert.org. CERT advisories and bulletins are also posted on the USENET newsgroup comp.security.announce. If you would like to have future advisories and bulletins mailed to you or to a mail exploder at your site, please send mail to cert-advisory-request(a)cert.org. If you wish to send sensitive incident or vulnerability information to CERT staff by electronic mail, we strongly advise that the e-mail be encrypted. The CERT Coordination Center can support a shared DES key, PGP (public key available via anonymous FTP on info.cert.org) or PEM (contact CERT staff for details). Internet email: cert(a)cert.org Telephone: +1 412-268-7090 (24-hour hotline) CERT personnel answer 8:30 a.m.-5:00 p.m. EST(GMT-5)/EDT(GMT-4), and are on call for emergencies during other hours. Fax: +1 412-268-6989 CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213-3890 USA CERT is a service mark of Carnegie Mellon University.

1 0

RADB cleanup - route objects with obsolete peers in advisory lists
by Brian Renaud 12 Jun '95

12 Jun '95

Some of the route objects in the RADB registry contain advisory lists which specify non-existant peers. (Many of these entries became incorrect when the NSFNET routers were shut down at the end of April.) We have produced a list of these route objects, which you can obtain via the web page: http://www.ra.net/routing.arbiter/RA/RADB.tools.docs/problems.html or, for those that prefer just ftp: ftp.ra.net:routing.arbiter/radb/problems/*.badav ftp.ra.net:routing.arbiter/radb/problems/*.badav.gz We would prefer not to modify your data. However, these entries need to be revised. On June 23, we will modify the advisory lines of any route objects in the RADB with references to non-existant peers. (The references to the peers will be removed and the preferences renumbered.) Please contact us at db-admin(a)ra.net if you have any questions about this. -Brian

1 0