February 2009 - NZNOG - lists.nznog.org

CCIP Alert: Adobe Acrobat unpatched vulnerability
by Paul McKitrick 21 Feb '09

21 Feb '09

Good Afternoon, For those of you who are not already aware, CCIP would like to bring your attention the the Critical Microsoft Security Bulletin MS09-002 that was released on February 10: http://www.microsoft.com/technet/security/bulletin/ms09-002.mspx Microsoft have announced a vulnerability in Internet Explorer 7 that could allow remote code execution if a user views a specially crafted Web page. Administrators are advised to patch immediately. Microsoft have rated as Critical for Window XP and Windows Vista and as Moderate for Windows Server 2003 and Windows Server 2008. CCIP is releasing this alert as it has been made aware of active exploitation of this vulnerability in the wild. Due to the recent impact of the Conficker worm CCIP wants to ensure that there is awareness of the active exploitation of MS09-002 and to encourage the patching of systems if they have not already been patched. AusCERT have a write up on their website: http://www.auscert.org.au/render.html?it=10477 There is also a write up on the Sourcefire Vulnerability Research Team’s blog: http://vrt-sourcefire.blogspot.com/2009/02/ms09-002-in-wild.html Regards, The CCIP Team -- Centre for Critical Infrastructure Protection Government Communications Security Bureau P: +64 4 498 7654 F: +64 4 498 7655 E: info(a)ccip.govt.nz I: www.ccip.govt.nz --- This e-mail contains official New Zealand Government information, which is intended for the use of addressees only. If you have received this e-mail in error, please notify the sender immediately and delete. You should not further disseminate, distribute or copy this e-mail in any way. ---

1 0

CCIP ALERT: Exploitation of MS09-002
by Paul McKitrick 21 Feb '09

21 Feb '09

Good Afternoon, For those of you who are not already aware, CCIP would like to bring your attention the the Critical Microsoft Security Bulletin MS09-002 that was released on February 10: http://www.microsoft.com/technet/security/bulletin/ms09-002.mspx Microsoft have announced a vulnerability in Internet Explorer 7 that could allow remote code execution if a user views a specially crafted Web page. Administrators are advised to patch immediately. Microsoft have rated as Critical for Window XP and Windows Vista and as Moderate for Windows Server 2003 and Windows Server 2008. CCIP is releasing this alert as it has been made aware of active exploitation of this vulnerability in the wild. Due to the recent impact of the Conficker worm CCIP wants to ensure that there is awareness of the active exploitation of MS09-002 and to encourage the patching of systems if they have not already been patched. AusCERT have a write up on their website: http://www.auscert.org.au/render.html?it=10477 There is also a write up on the Sourcefire Vulnerability Research Team’s blog: http://vrt-sourcefire.blogspot.com/2009/02/ms09-002-in-wild.html Regards, The CCIP Team -- Centre for Critical Infrastructure Protection Government Communications Security Bureau P: +64 4 498 7654 F: +64 4 498 7655 E: info(a)ccip.govt.nz I: www.ccip.govt.nz --- This e-mail contains official New Zealand Government information, which is intended for the use of addressees only. If you have received this e-mail in error, please notify the sender immediately and delete. You should not further disseminate, distribute or copy this e-mail in any way. ---

1 0

NZNOG-09 Videos
by Richard Naylor 20 Feb '09

20 Feb '09

Video and audio (MP3) from NZNOG 09 is available at http://www.r2.co.nz/20090129/ There is both streamed and downloadable versions, and versions in wmv, MP4 and MP3. One talk was not recorded at the request of the presenter. The video isn't too bad - the lighting was a challenge, and there was no one driving the audio desk, so the feed we got varied a little. But it should be quite usable for those who couldn't make it. Richard

1 0

Voting process
by Skeeve Stevens 19 Feb '09

19 Feb '09

Just a quick question about the APNIC EC elections. If someone has a lot of votes/proxies, and they don't get up, are they able to pass their votes to someone else? ...Skeeve -- Skeeve Stevens, CEO/Technical Director eintellego Pty Ltd - The Networking Specialists skeeve(a)eintellego.net / www.eintellego.net Phone: 1300 753 383, Fax: (+612) 8572 9954 Cell +61 (0)414 753 383 / skype://skeeve -- NOC, NOC, who's there? Disclaimer: Limits of Liability and Disclaimer: This message is for the named person's use only. It may contain sensitive and private proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of companies reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity. Any reference to costs, fee quotations, contractual transactions and variations to contract terms is subject to separate confirmation in writing signed by an authorised representative of eintellego. Whilst all efforts are made to safeguard inbound and outbound e-mails, we cannot guarantee that attachments are virus-free or compatible with your systems and do not accept any liability in respect of viruses or computer problems experienced.

8 8

New Telstra transparent proxy/config?
by Joel Wiramu Pauling 19 Feb '09

19 Feb '09

Over the last 24-48 hours I have noticed that I am seeing my IP being mis-represented quite often as 203.98.50.27 which appears to be a new upstream proxy hop I have not seen before: traceroute to 203.98.50.27 (203.98.50.27), 30 hops max, 40 byte packets 1 121-73-24-1.cable.telstraclear.net (121.73.24.1) 18.037 ms 17.681 ms 17.413 ms 2 ae0-840.ie4.telstraclear.net (203.167.223.114) 12.952 ms 12.781 ms 12.475 ms 3 ge-1-2-0-843.ie1.telstraclear.net (218.101.61.105) 21.357 ms 20.910 ms 20.661 ms 4 203.98.50.27 (203.98.50.27) 24.332 ms 24.066 ms 23.950 ms I have noticed it preventing non http traffic flowing across port 80 (netcat to amazon cloud), as well as interfering with stun and various other bits and pieces, (incoming and outgoing connections to/from local webserver take longer than usual) Can anyone confirm similar behaviour who is on Telstra cable network, or have further details. Appears to be a netcache proxy. Proxy Server Details: 1.1 nc2 (NetCache NetApp/6.0.5P1) Kind regards -JoelW

5 6

S92A - Public demonstration at MIDDAY parliament grounds
by Andrew Ruthven 18 Feb '09

18 Feb '09

[Forwarded, very last minute, sorry for the late warning] Hi folks, So today there is a public demonstration at MIDDAY on Parliament grounds in support of MPs speaking against Section 92A. Details are here: http://creativefreedom.org.nz/story.html?id=127 "In Wellington on the steps of Parliament on Thursday 19th at MIDDAY with a petition handover at 12:30pm. This is a postive event where we will hand out hundreds of CDs and thank the politicans that support us - so please keep it friendly and polite. While we appreciate people arranging their own demonstrations it might be best if we don't dilute our numbers with multiple events. We want everyone reading this to email everyone they know in Wellington about this. We can't let this be another internet protest that results in few people turning up. This is important so we need to prove it in numbers. NOTE: Please don't wear all black as that has negative associations with other demonstrations but instead come along with bright clothes and BLACK PLACARDS!" As an example of how to be awesome do this: http://coffee.geek.nz/public-demonstration.html Now here's the sobering bit... We need everyone you can get to be there. This is a lot about establishing the credibility of the anti-S92A voice in numbers. If you can bring your friends and co-workers that's the kind of thing that will make this work. We need all of your support -- don't think that other will do it -- we need you to be there MIDDAY. Thanks, Matthew Holloway Creative Freedom -- Andrew Ruthven, Wellington, New Zealand At home: andrew(a)etc.gen.nz | linux.conf.au 2010 | Follow the signs. Visit Wellington! | http://www.penguinsvisiting.org.nz

2 1

NZRR Route Registry Update
by NZRR Database Notifications 18 Feb '09

18 Feb '09

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES6:AS131110 descr: Route set advertised to AS9439 by Slush Technologies - AS131110 mp-members: 2001:4410:2005:0:0:0:0:0/48^48-64 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: dene(a)slush.ca mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20080910 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES6:AS131110 descr: Route set advertised to AS9439 by Dane Foster - AS131110 mp-members: 2001:4410:2005:0:0:0:0:0/48^48-64, 2001:0470:a080:0:0:0:0:0/48^48-64 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: dane(a)citylink.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20090219 source: NZRR ------------------------------------------------------------

1 0

NZRR Route Registry Update
by NZRR Database Notifications 16 Feb '09

16 Feb '09

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS24183 descr: advertised to AS9439 by DTS Ltd - AS24183 members: 202.68.80.0/20^20-29, 210.48.160.0/20^20-29, 117.18.80.0/21^21-29, 202.20.0.0/21^21-29, 202.27.88.0/23^23-29, 202.174.178.0/23^23-29, 202.174.184.0/23^23-29, 202.174.190.0/23^23-29, 192.173.17.0/24^24-29, 202.27.90.0/24^24-29, 202.36.137.0/24^24-29, 202.36.173.0/24^24-29, 202.37.197.0/24^24-29, 203.170.56.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: vaa(a)dts.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20090120 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS24183 descr: advertised to AS9439 by DTS Ltd - AS24183 members: 202.68.80.0/20^20-29, 210.48.160.0/20^20-29, 117.18.80.0/21^21-29, 202.20.0.0/21^21-29, 202.27.88.0/23^23-29, 202.174.178.0/23^23-29, 202.174.184.0/23^23-29, 202.174.190.0/23^23-29, 192.173.17.0/24^24-29, 202.27.90.0/24^24-29, 202.36.137.0/24^24-29, 202.36.173.0/24^24-29, 202.37.197.0/24^24-29, 203.170.56.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: vaa(a)dts.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20090217 source: NZRR ------------------------------------------------------------

1 0

FileMaker Pro 10 - now with IPv6
by Skeeve Stevens 15 Feb '09

15 Feb '09

Hey all, Just a bit of data for you network guys and application hosting guys out there... Filemaker Pro 10 which has just been released is saying that it "Complies with Internet Protocol Version 6 standards." http://www.filemaker.com/products/fmp/all_features.html Good to see mainstream applications adopting and promoting it. -- Skeeve Stevens, CEO/Technical Director eintellego Pty Ltd - The Networking Specialists skeeve(a)eintellego.net / www.eintellego.net Phone: 1300 753 383, Fax: (+612) 8572 9954 Cell +61 (0)414 753 383 / skype://skeeve -- NOC, NOC, who's there? Disclaimer: Limits of Liability and Disclaimer: This message is for the named person's use only. It may contain sensitive and private proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of companies reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity. Any reference to costs, fee quotations, contractual transactions and variations to contract terms is subject to separate confirmation in writing signed by an authorised representative of eintellego. Whilst all efforts are made to safeguard inbound and outbound e-mails, we cannot guarantee that attachments are virus-free or compatible with your systems and do not accept any liability in respect of viruses or computer problems experienced.

10 14

2009 APNIC EC Election – Voting criteria
by Srinivas (Sunny) Chendi 12 Feb '09

12 Feb '09

_______________________________________________________________________ 2009 APNIC EC Election – Voting criteria _______________________________________________________________________ The APNIC Executive Council (EC) 2009 elections will be held at the APNIC Member Meeting (AMM) on Friday, 27 February 2009. The members whose positions are up for reelection are Kuo-Wei Wu, Kusumba Sridhar, Mao Wei, and Ming-Cheng Liang. Voting criteria --------------- Only APNIC Members or their assigned proxies may vote at the EC elections. Voting may be done online using MyAPNIC, or onsite with a paper ballot at the AMM. By default, all voting rights are controlled by the Member’s Corporate Contact. To cast a vote the Corporate Contact may vote themselves, or may assign voting rights to another registered APNIC contact (using MyAPNIC), or appoint external representatives as a proxy to vote on their behalf. A proxy voter may be any individual and need not be an employee of the Member organization or APNIC Members in their own right. A proxy appointment is only valid when confirmed by the APNIC Secretariat. Proxy voters may only vote onsite and must be registered for the AMM. For more information about appointing a proxy, see http://meetings.apnic.net/elections/about/proxy.html Online voting ------------- Online voting opens on 16 February 2009 and closes on 25 February 2009 (09:00 UTC+8, Manila time). It is only available with valid digital certificate access to the MyAPNIC Member website. An online vote cannot be withdrawn after it has been submitted. Onsite voting ------------- Onsite voting takes place at the AMM on 27 February 2009. Ballots can be collected by the Corporate Contact, a Member representative with voting rights assigned by the Corporate Contact, or a proxy voter. For more on how to vote and the list of current nominees, see http://meetings.apnic.net/elections/about/voting/how.html Regards -------------------------------------------------------------------- Srinivas (Sunny) Chendi email: sunny(a)apnic.net External Relations Manager, APNIC sip: sunny(a)voip.apnic.net http://www.apnic.net ph/fx: +61 7 3858 3100/99 ____________________________________________________________________ * Join us for APNIC 27 in Manila, 23-27 February 2009! * A fun week of workshops, seminars, and policy discussion awaits! * * For more information, see: http://meetings.apnic.net ____________________________________________________________________

1 0