- NZNOG - lists.nznog.org

Error
by Sahil Gupta - NET4U LIMITED 10 Aug '03

10 Aug '03

Apologies, the network is 202.50.167.0/24 and not 202.50.267.0/24 Regards, Sahil Gupta Senior Account Manager NET4U LIMITED Phone: 0508-263-848 Fax: 07-8582659 Mobile: 029-366-6375

1 0

Prefix-List Update for Net4U Limited (AS23746)
by Sahil Gupta - NET4U LIMITED 10 Aug '03

10 Aug '03

Hi, Could ISP's currently peering with Net4U at APE kindly add the below listed network to the net4u's current prefix-list: 202.50.267.0/24 A full prefix-list is attached. Regards, Sahil Gupta Senior Account Manager NET4U LIMITED Phone: 0508-263-848 Fax: 07-8582659 Mobile: 029-366-6375

1 0

RE: [nznog] Re:Domain Name Scams
by Paul Adshead 10 Aug '03

10 Aug '03

It is to be fair, incredibly simple to find out most of the information regarding the allocation of a domain. Just go to the main DomaiNZ page: www.domainz.net.nz and enter your (NZ) domain name into the search box on the left. After selecting OK, then a warning about not being able to use this information for any other purpose appears - and this warning automatically disappears after a few seconds anyway. After this, then all of the details for the queried domain appear! As the warning message automatically disappears, then the content of the warning is probably not legally enforceable anyway - you could have been looking away from your screen at that point! They should have a "Yes I've read the above agreement" checkbox before you can proceed... Possible ways that the scam has found out the contact info: - if you knew enough about HTML, ASP and VB, it would be simple enough to write a program that once every five seconds sent a request to the DomaiNZ webserver starting at "a.co.nz" and finishing at "zzzzzzz999.net.nz", to find out the information for the various domains - it would take a while though; - you could use an 'electronic dictionary' of words in order to cut down on the unlikely examples; - there is also probably an online listing somewhere, of all of the currently active companies in New Zealand, you could then just try "<company name>.co.nz" and "<company name>.net.nz". There are far too many ways that people could have done it. I'm not condoning what has happened and have not done so myself, I'm just trying to explain how easy it is to do so. I was hit with three renewals too... Paul Adshead Network and Systems Manager OTL Software Ltd www.otl.co.nz -----Original Message----- From: Juha Saarinen [mailto:juha(a)saarinen.org] Sent: Friday, 8 August 2003 13:04 To: PhoneNet Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Re:Domain Name Scams On Fri, 8 Aug 2003, PhoneNet wrote: > I have today received 5 letters from The Domain Registry of America, > Melbourne (posted in UK) asking me to re-register some of my domains as > they are due to expire - so they are at it also. Got one here as well, and what bothers me is that although the domain in question is registered under my own name, the letter was addressed to my company, which doesn't appear in whois data anywhere. Somebody's been trawling... -- Juha Saarinen _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

5 5

FW: [nznog] Re:Domain Name Scams
by Tim John 09 Aug '03

09 Aug '03

> Just go to the main DomaiNZ page: www.domainz.net.nz and > enter your (NZ) > domain name into the search box on the left. After selecting > OK, then a > warning about not being able to use this information for any > other purpose > appears - and this warning automatically disappears after a > few seconds > anyway. After this, then all of the details for the queried > domain appear! > As the warning message automatically disappears, then the > content of the > warning is probably not legally enforceable anyway - you > could have been > looking away from your screen at that point! They should > have a "Yes I've > read the above agreement" checkbox before you can proceed... > Actually, the warning message appears on the Domainz homepage, the 'SRS is being queried' page and the results page. It only disappears when the page reloads with the results. It's only a GUI'd representation of a WhoIs query. On registration, there is a physical need to click a "I've read the terms of service" button, but at the end of the day, any information entered as part of a domain name registration is available in the public domain. Tim > Possible ways that the scam has found out the contact info: > - if you knew enough about HTML, ASP and VB, it would be > simple enough to > write a program that once every five seconds sent a request > to the DomaiNZ > webserver starting at "a.co.nz" and finishing at > "zzzzzzz999.net.nz", to > find out the information for the various domains - it would > take a while > though; > - you could use an 'electronic dictionary' of words in order > to cut down on > the unlikely examples; > - there is also probably an online listing somewhere, of all of the > currently active companies in New Zealand, you could then > just try "<company > name>.co.nz" and "<company name>.net.nz". > > There are far too many ways that people could have done it. > > I'm not condoning what has happened and have not done so > myself, I'm just > trying to explain how easy it is to do so. I was hit with > three renewals > too... > > Paul Adshead > Network and Systems Manager > OTL Software Ltd > www.otl.co.nz > > > -----Original Message----- > From: Juha Saarinen [mailto:juha(a)saarinen.org] > Sent: Friday, 8 August 2003 13:04 > To: PhoneNet > Cc: nznog(a)list.waikato.ac.nz > Subject: Re: [nznog] Re:Domain Name Scams > > > On Fri, 8 Aug 2003, PhoneNet wrote: > > > I have today received 5 letters from The Domain Registry > of America, > > Melbourne (posted in UK) asking me to re-register some of > my domains as > > they are due to expire - so they are at it also. > > Got one here as well, and what bothers me is that although > the domain in > question is registered under my own name, the letter was > addressed to my > company, which doesn't appear in whois data anywhere. > > Somebody's been trawling... > > -- > Juha Saarinen > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > DISCLAIMER: The content of this email is confidential and may contain legally privileged information intended only for the individual or entity named above. Access to this message by anyone else is unauthorised. If you are not the intended recipient, please be advised that the use, distribution and publication of the above information is prohibited. If you have received this email in error, please contact Domainz by returning the email and destroying the original. Thank you.

1 0

Info Session: Certificate In Web-based Instruction
by Abigail 08 Aug '03

08 Aug '03

On Thursday, August 14th at 1100 hrs Pacific Standard Time (GMT 08:00) there will be a Webcast featuring the instructors of the Certificate in Web-Based Instruction (CWI). Webcast participants can ask questions and interact with the instructors of this 24 week program that will be offered entirely online beginning September 15, 2003. The CWI program gives you the tools and knowledge necessary to design, develop and deliver Web-based courses or add online components to the face-to-face classroom. Please register to participate in the live Webcast by visiting http://www.sfu.ca/lidc/telestraining. If you are unable to make it to this live presentation at the above date then you can attend our next Webcast scheduled for Wednesday, September 3 at 1100 hrs PST (GMT 8:00). Abby Dy Communications Specialist Certificate in Web-Based Instruction Tel: 604-806-5156 ady(a)sfu.ca

1 0

DomainNamesNZ
by Felix Tsang 07 Aug '03

07 Aug '03

I recon their misleading letters should be taken up with the commerce commission. Felix Tsang

8 7

DomainNamesNZ
by Dominic O'Hare 07 Aug '03

07 Aug '03

The company "DomianNamesNZ" is actually "Domain Names Australia Pty Limited" a Australian based company incorporated in Victoria. They also go by "Internet Registry Pty Limited" and "NetRegister" (Not NetRegistry). The address they're using, the ASB tower in Auckland is an internet bought mail forwarding address. They have also done mail-outs and fax-outs in Australia - http://www.auda.org.au/about/news/2003061903.html One thing interesting is that they have sent letters to customers of Internet Name Group (ING) who did a similar mail-out in NZ in a while back, the letters were filled with B.S and obviously asked they register renew domains with them. Regards, Dominic

2 1

Re: [nznog] Re:Domain Name Scams
by Jamie Baddeley 07 Aug '03

07 Aug '03

got one here too. >>> Juha Saarinen <juha(a)saarinen.org> 8/8/2003 1:03:46 PM >>> On Fri, 8 Aug 2003, PhoneNet wrote: > I have today received 5 letters from The Domain Registry of America, > Melbourne (posted in UK) asking me to re-register some of my domains as > they are due to expire - so they are at it also. Got one here as well, and what bothers me is that although the domain in question is registered under my own name, the letter was addressed to my company, which doesn't appear in whois data anywhere. Somebody's been trawling... -- Juha Saarinen _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

TelstraClear Routing?
by Steve Withers 07 Aug '03

07 Aug '03

I've been using a VPN to connect to work across the WIX for over a year - via a Paradise cable modem. I was seeing about 1mbps throughput, consistent with AT&T's Wellington Office (the actual people-at-desks office) United Networks connection to the WIX. A traceroute showed roughly 5-6 hops as I recall. Today....I can't get my VPN tunnel up at all and the traceroute shows 15 hops and my traffic is going to Auckland and off to Reach in HongKong...and then into AT&T's network there and then back again via Australia to NZ. Is anyone else seeing similar routing troubles? -- Steve Withers <swithers(a)mmp.org.nz>

2 1

OT: MP3 player
by Tim John 07 Aug '03

07 Aug '03

Hi, Sorry for the off topic posting, but during the Netforum conference last month, Domainz were selling 128Mb MP3 players for $120 (including GST) to it's participants; it was just for a bit of fun. I have a number of these little devices left - which double as pen drives - so if anyone would like one, please visit the following URL and I'll organise one to be sent out. Delivery is $7.50 (within New Zealand). https://www.domainz.net.nz/mp3/order.asp Again, sorry for taking this off topic, but wanted to wanted to offer these to all. Tim DISCLAIMER: The content of this email is confidential and may contain legally privileged information intended only for the individual or entity named above. Access to this message by anyone else is unauthorised. If you are not the intended recipient, please be advised that the use, distribution and publication of the above information is prohibited. If you have received this email in error, please contact Domainz by returning the email and destroying the original. Thank you.

1 0

Re: Nznog Digest, Vol 8, Issue 4
by Paul J 07 Aug '03

07 Aug '03

maybe try http://www.lucentdocs.com/ ? >>>>>MAX4000/6000 You'll first need to 'enable' yourself with what ever max enable password you have set on the max box. ctrl + d >P=Password >00-309 Full Access <password> ctrl + d >E=Termsrv show users kill <session ID> <<<<< >>>>>MAXTNT userstat (or users | grep <string>) users -k <session ID> <<<<< ----- Original Message ----- From: "Robert Mena" <rt_mena(a)yahoo.com> To: <nznog(a)list.waikato.ac.nz> Sent: Friday, August 08, 2003 2:22 AM Subject: [nznog] Re: Nznog Digest, Vol 8, Issue 4 > Hi Simon, > > I do live in Brazil and I was not aware that this was > a problem for the list. > > The IP you mantioned is probably the cable modem > company. > > I do not know how to get in this termserv mode. When > I need to to things I telnet to MAX, login as admin. > > I've tryed that kill with no luck. Sould I read > <something> first ? > > ------------ > Message: 2 > Date: Thu, 7 Aug 2003 13:42:20 +1200 (NZST) > From: Simon Lyall <simon.lyall(a)ihug.co.nz> > Subject: Re: [nznog] disconectin users in a MAX TNT > To: <nznog(a)list.waikato.ac.nz> > Message-ID: > > <Pine.LNX.4.30.0308071332230.19531-100000(a)boggle.ihug.co.nz> > Content-Type: TEXT/PLAIN; charset=US-ASCII > > On Wed, 6 Aug 2003, Robert Mena wrote: > > I was wondering how can I disconnect a user from a > MAX > > TNT ? > > 1. Why are you posting to nznog when you're in Brazil? > > 2. You apepar to have a slight spam problem: > > http://www.moensted.dk/spam/?addr=200.174.69.242 > > Maybe you'll be able to disconnect them now.. > > > 3. Are you useing a TNT or a MAX ? They are a little > different... > > 4. On a TNT run: > > > userstat ? > > On a Max go into Termsrv mode and run: > > % show users > % kill <session ID> > > __________________________________ > Do you Yahoo!? > Yahoo! SiteBuilder - Free, easy-to-use web site design software > http://sitebuilder.yahoo.com > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > Paul Joslin Systems Administrator Network Operations Center IHUG LTD, Auckland, New Zealand www.ihug.co.nz

1 0

Re: Nznog Digest, Vol 8, Issue 4
by Robert Mena 06 Aug '03

06 Aug '03

Hi Simon, I do live in Brazil and I was not aware that this was a problem for the list. The IP you mantioned is probably the cable modem company. I do not know how to get in this termserv mode. When I need to to things I telnet to MAX, login as admin. I've tryed that kill with no luck. Sould I read <something> first ? ------------ Message: 2 Date: Thu, 7 Aug 2003 13:42:20 +1200 (NZST) From: Simon Lyall <simon.lyall(a)ihug.co.nz> Subject: Re: [nznog] disconectin users in a MAX TNT To: <nznog(a)list.waikato.ac.nz> Message-ID: <Pine.LNX.4.30.0308071332230.19531-100000(a)boggle.ihug.co.nz> Content-Type: TEXT/PLAIN; charset=US-ASCII On Wed, 6 Aug 2003, Robert Mena wrote: > I was wondering how can I disconnect a user from a MAX > TNT ? 1. Why are you posting to nznog when you're in Brazil? 2. You apepar to have a slight spam problem: http://www.moensted.dk/spam/?addr=200.174.69.242 Maybe you'll be able to disconnect them now.. 3. Are you useing a TNT or a MAX ? They are a little different... 4. On a TNT run: > userstat ? On a Max go into Termsrv mode and run: % show users % kill <session ID> __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com

1 0

RE: [nznog] DomainNamesNZ
by Steve Phillips 06 Aug '03

06 Aug '03

I received one of these as well requesting i register my name with a .net (not .net.nz) extension - this may produce even more issues as this would be outside the control of the DNC. the listed address is 20, 135 Albert St in Auckland - I considered wandering into town to go and LART them in person.. my domain was only registered February of this year so they have managed to get a list of .nz names after this point. -- Steve. At 14:14 7/08/2003, Tim John wrote: >This has been taken up by the DNC - check out her website for the latest >info. > >I'm not sure whether they are using an old version of the .nz zone file >(although these haven't been available for at least 18 months), or they have >some scripting engine pulling the information of the general WhoIs. This >breaches the DNC policy on use of private information for commercial gain, >yada, yada ... > >Tim

2 1

DomainNamesNZ
by Matthew G Brown 06 Aug '03

06 Aug '03

I've been getting a few good old snail mail letters from Domainnamesnz.com offering me to register domain names. Eg: I own learnbydestroying.co.nz and the "offer" is for learnbydestroying.net . How ever since these letters include; Reference #, MPID ? , Closing Date, Credit card details, and very little info to conclude that this is a Renewal many people have inadvertently paid the money ( $237 for two years ! ) thinking it's a Domainz or other registrar invoice. I'm not questioning the legality of this , as I am no expert, how ever im interested to know how so many of my clients and myself ended up with these letters? Anyone else experienced these letters or perhaps had clients pay for what they thought was a valid renewal? Best Regards Matthew G Brown Managing Director B & R Holdings LIMITED Nelson, New Zealand Ph: 027 4807731 Http://www.brh.co.nz

4 5

RE: [nznog] DomainNamesNZ
by mark.harris＠ssc.govt.nz 06 Aug '03

06 Aug '03

From: Tim John > I'm not sure whether they are using an old version of > the .nz zone file (although these haven't been available > for at least 18 months), or they have some scripting > engine pulling the information of the general WhoIs. It's not an old one and they didn't get it from Domainz. One of the domains I got a note about was only registered a few months ago via Freeparking. As an aside, this will work on some people. My wife (who is not unclueful) was opening the mail, handed me the nonvoices and said "Bills from Domainz. Do you want me to pay them online?" People will read what they think they see, no matter how much clue you throw at them. Cheers Mark Harris Senior Advisor, Portal Operations State Services Commission PO Box 329, Wellington, NZ Tel: 64 4 495 2844

1 0

RE: [nznog] DomainNamesNZ
by Paul Adshead 06 Aug '03

06 Aug '03

I have also received a .net.nz 'renewal' for each of the three .co.nz domains that I have! You have to read very carefully before you actually realise that it is a proposal rather than a renewal.. :-( Paul Adshead Network & Systems Manager OTL Software Ltd www.otl.co.nz -----Original Message----- From: Dan Clark [mailto:dan(a)scarfies.net] Sent: Thursday, 7 August 2003 14:14 To: Matthew G Brown; nznog(a)list.waikato.ac.nz Subject: Re: [nznog] DomainNamesNZ yes, we have received around 1/2 a dozen so far, some of my clients got them directly and were just going to pay it! hrmm, in reading the small print on the back it also says something about not being able to change registrar's for a whole 60 days after 'transferring to them' Regards Dan Clark Network Manager Scarfies.Net Ltd Wickliffe Ltd ----- Original Message ----- From: "Matthew G Brown" <Matt(a)Brh.Co.Nz> To: <nznog(a)list.waikato.ac.nz> Sent: Thursday, August 07, 2003 2:09 PM Subject: [nznog] DomainNamesNZ > I've been getting a few good old snail mail letters from > Domainnamesnz.com offering me to register domain names. Eg: I own > learnbydestroying.co.nz and the "offer" is for learnbydestroying.net . > How ever since these letters include; Reference #, MPID ? , Closing > Date, Credit card details, and very little info to conclude that this is > a Renewal many people have inadvertently paid the money ( $237 for two > years ! ) thinking it's a Domainz or other registrar invoice. > > I'm not questioning the legality of this , as I am no expert, how ever > im interested to know how so many of my clients and myself ended up with > these letters? Anyone else experienced these letters or perhaps had > clients pay for what they thought was a valid renewal? > > > > Best Regards > > Matthew G Brown > Managing Director > B & R Holdings LIMITED > Nelson, New Zealand > Ph: 027 4807731 > Http://www.brh.co.nz > > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

disconectin users in a MAX TNT
by Robert Mena 06 Aug '03

06 Aug '03

Hi, I was wondering how can I disconnect a user from a MAX TNT ? With other RAS I could reset SXX where XX would be the session it is attached to. Unfortunately under MAX I could not find the proper command, reset, kill, drop, disconnect etc... __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com

2 1

Orcon Internet Prefix List Update (2003-08-07)
by Craig Whitmore 06 Aug '03

06 Aug '03

For all those peering with Orcon Internet (AS17746) please update your Prefix Lists/BGP to allow the Following Network (202.50.176.0/24) ip prefix-list orcon-national permit 202.50.176.0/24 Thanks Craig Whitmore Systems Administrator Orcon Internet http://www.orcon.net.nz

1 0

2500 PS
by Jon Leeman 05 Aug '03

05 Aug '03

Thanks to all that responded to Andy's plea, on my behalf, for a 2500 series power supply. I've managed to find a supplier in NZ - a list member - and it should be here in a couple of weeks. In the meantime we got the box running per the solution at http://www.hardstaff.com/Computer/Cisco/index.html and it's been working for about a week now with no apparent problems. Cheers, Jon

1 0

RE: IP to PSTN/Public network gateway.
by Gavin Legge [Invincible Technologies Limited NZ] 05 Aug '03

05 Aug '03

Thank you everyone for your comments. After a call to chch (thank's Matt) and a look at fx.net.nz i think i have all i need for now - at least a damn good start and all the right contacts. so thanks again to all. Now - how to get the normal PSTN voice calls routed back to the IP pbx/phone... hmm - time to jump into bed with a telco i think or at least connect to one .. IP/CCS7 POI/interface anyone?? lol cheers Gavin

1 0

IP to PSTN/Public network gateway.
by Gavin Legge [Invincible Technologies Limited NZ] 05 Aug '03

05 Aug '03

First question from a new list member (probably go straight to FAQ no?).... Does anyone know of a (preferably) New Zealand based provider that provides an 'IP' to 'public network' and back again gateway service (at a charge or otherwise)? Somewhere we can fire IP voice calls at, that will take the IP voice call and poke it out to the local number, local number being a normal everyday phone connected to the PSTN ? Thanks for any advice Regards Gavin Legge

1 0

Cisco 2500 power supply
by Andy Linton 04 Aug '03

04 Aug '03

Anybody got a spare 2500 power supply that Jon Leeman in Nauru can have for his 2509 dial in box? If there's a box that can be cannibalised that's fine. Include Jon on any replies if you can help. andy

1 0

Newbie with MAX : how to set up aditional pools
by Robert Mena 04 Aug '03

04 Aug '03

Hi, I am trying to configure an already running MAX TNT with TAOS 8.0.2. I need to change the current pool and add a new pool. Does anybody have a howto for that ? I've searched and downloaded the PDFs but no luck so far... Regards. __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com

2 1

RE: [nznog] 411 Scam
by Carl Black 04 Aug '03

04 Aug '03

Yes, actually - in the last month I've noticed about 4 to 5 times the amount of 411 spam I would normally expect hitting my organisation. > -----Original Message----- > From: Barry Murphy [mailto:barry(a)unix.co.nz] > Sent: Monday, August 04, 2003 10:54 PM > To: nznog(a)list.waikato.ac.nz > Subject: [nznog] 411 Scam > > > Hi, > > Just wondering if anyone else is being bombarded with 411 > scams of late. > Until a week ago I had only received maybe 6 over the year, > but over the > last 2 weeks I have received about 2-5 a day. > > Cheers > Barry > > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog >

1 0

411 Scam
by Barry Murphy 04 Aug '03

04 Aug '03

Hi, Just wondering if anyone else is being bombarded with 411 scams of late. Until a week ago I had only received maybe 6 over the year, but over the last 2 weeks I have received about 2-5 a day. Cheers Barry

2 1

Looking for Cisco VIP4
by Craig Whitmore 29 Jul '03

29 Jul '03

Hi folks.. I'm urgently looking for a few VIP2's or a VIP4 or above for a Cisco 7500. If anyone can help please let me know. Also if anyone has any type of IO Controller for a 7200 it would be great as well. Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz

1 1

RE: [nznog] Uniforum Meeting and Various Belated Thank-Yous
by Tim John 29 Jul '03

29 Jul '03

Hi Joe, It was a pleasure for Domainz to be able to bring you to the Conference and I'm sure your presence was appreciated by everyone. However, the least you could have done was bought an MP3 player off me ... :) Tim -----Original Message----- From: Joe Abley [mailto:jabley(a)isc.org] Sent: Tuesday, 29 July 2003 7:44 p.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] Uniforum Meeting and Various Belated Thank-Yous (warning! non-operational content. Press "d" now.) This is going to sound a little bit like a delayed reaction, but I've been travelling wildly since the meeting and hence have something of a mental meme backlog. It was very pleasant to be back putting names to faces and waving my hands in front of a whiteboard. Many thanks to Roger & Co for organising the meeting, and for inviting me to come down and speak. My travel to Auckland was paid for by Domainz -- without their funding I likely would not have been able to visit to talk at the meeting, nor turn up the F root server instance in Auckland in July (if your traceroute to f.root-servers.net currently leaves the country, feel free to contact peering(a)isc.org to set up a peering session with us in Auckland, or encourage your ISP to do the same). Direct assistance and ongoing donations of time, network, colo and equipment for the F root server were provided by Juniper, TelstraClear, Citylink, FX Networks and 2day.com, all of whom should hereby consider themselves heartily thanked. http://www.isc.org/ISC/news/pr-07232003.html Joe _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog DISCLAIMER: The content of this email is confidential and may contain legally privileged information intended only for the individual or entity named above. Access to this message by anyone else is unauthorised. If you are not the intended recipient, please be advised that the use, distribution and publication of the above information is prohibited. If you have received this email in error, please contact Domainz by returning the email and destroying the original. Thank you.

1 0

UseNet's Looking Glass...
by Dan Clark 29 Jul '03

29 Jul '03

Hi Guys, The UseNet Looking Glass http://www.usenet.net.nz/lg.cgi web server, appears to not be parsing cgi scripts? Does anyone have a traceroute looking glass, close to the APE, I could use for a minute or two please? Regards Dan Clark Network Manager Wickliffe Ltd Scarfies.Net Ltd

7 9

Uniforum Meeting and Various Belated Thank-Yous
by Joe Abley 28 Jul '03

28 Jul '03

(warning! non-operational content. Press "d" now.) This is going to sound a little bit like a delayed reaction, but I've been travelling wildly since the meeting and hence have something of a mental meme backlog. It was very pleasant to be back putting names to faces and waving my hands in front of a whiteboard. Many thanks to Roger & Co for organising the meeting, and for inviting me to come down and speak. My travel to Auckland was paid for by Domainz -- without their funding I likely would not have been able to visit to talk at the meeting, nor turn up the F root server instance in Auckland in July (if your traceroute to f.root-servers.net currently leaves the country, feel free to contact peering(a)isc.org to set up a peering session with us in Auckland, or encourage your ISP to do the same). Direct assistance and ongoing donations of time, network, colo and equipment for the F root server were provided by Juniper, TelstraClear, Citylink, FX Networks and 2day.com, all of whom should hereby consider themselves heartily thanked. http://www.isc.org/ISC/news/pr-07232003.html Joe

1 0

RE: [nznog] Staff remote access
by barry＠unix.co.nz 27 Jul '03

27 Jul '03

Sorry about that, should have been offlist. Barry ------------------------------------------------------------- This mail sent through UnixCo Webmail: http://www.unix.co.nz/

1 0

Staff remote access
by nward＠esphion.com 27 Jul '03

27 Jul '03

I currently have an IPExpress circuit from TelstraClear providing Internet access. I'd like to be able to have staff use some kind of fast IP service (ie ADSL), to connect in to the office to do thier work, I don't want Internet access over these links, just some form of nationally accessable 'VPN'. It only needs to be 1-2Mbit speed, but can't complain if its more. Is this kind of thing being done? I tried to contact Telecom about it only to have some customer support monkey tell me that ADSL is an Internet thing, and as much as I love dealing with support people... I assume many replies to this will be deemed commercial and OT, so please contact me off-list. Nathan Ward

2 1

Linux beginners training
by Jonathon Horsman 27 Jul '03

27 Jul '03

Hi all Sorry for this rather blatant advertisement, but I believe this may be of interest to some. I am running a one day Linux beginners training in Auckland this Saturday (2nd of August). Details can be found here: http://www.59uptime.com/training.html Please email me if you're interested in attending. Thanks very much Jonathon

1 0

Notification: Disable Seconday Public (Stratum 2) NTP Service
by Kim Shepherd 24 Jul '03

24 Jul '03

The University of Waikato will cease to provide public stratum 2 NTP service as of 31st July, 2003. A list of alternative stratum 2 servers is available at the URL below: http://www.eecis.udel.edu/~mills/ntp/clock2a.html Regards, Kim. -- Kim Shepherd Systems Operator/Administrator ITS Systems & Development The University of Waikato, Hamilton, New Zealand DDI: +64-7-838-4681 Mob: +64-25-240-8682 Mail: kims(a)waikato.ac.nz

1 0

Fwd: 100,000 Reasons ...
by barry＠unix.co.nz 23 Jul '03

23 Jul '03

Anyone else receiving spam which "is not part of a mass mailout" ? They even fail to refer to which domain I should keep with domainz, as far as I know I have moved my domains over to orcon almost a month ago. Barry ----- Forwarded message from Domainz(a)domainz.net.nz ----- Date: Mon, 21 Jul 2003 11:39:53 +1200 From: Domainz(a)domainz.net.nz Reply-To: Domainz(a)domainz.net.nz Subject: 100,000 Reasons ... To: blacklabel(a)orcon.net.nz This email has been sent directly to 'blacklabel(a)orcon.net.nz' and is not part of a mass mailout. ----- <http://www.domainz.net.nz> <http://www.domainz.net.nz> <http://www.domainz.net.nz/> <http://www.domainz.net.nz> You now have a choice of registrars to manage your domain name requirements. At Domainz, we've registered more than 100,000 .nz domain names over the past six years, making us the specialists. So while you now have a choice, we think it's best exercised by doing nothing! That way you can ensure Domainz remains your registrar. Why stay with Domainz? Because your domain name is a valuable asset that needs to be properly protected and managed. We're New Zealand's most experienced and expert domain name registrar - and that makes us the people you should rely on for top service and best value for money. Domain names are our speciality! What else do I get by doing nothing? We are now able to offer you other services alongside your domain name registration. Right now, you can have: * Domain name parking - domain name reservation *FREE* * Website redirection - redirection of your website traffic so you can have it managed wherever you want *FREE* * Email forwarding - we can redirect your email to wherever you want *FREE* * Email hosting - we'll manage your whole email system using our facilities * Web hosting - we'll do the same with your website Domainz offers all of our services in a range of packages designed to fit the differing requirements of our customers. What will I miss if I act now? Remember, there's no need to do anything - and we strongly advise that you don't! Very soon we'll be offering a range of new products and services, including: * More billing and payment options - including variable registration periods for domain names * Registration of international domain names - such as .com, .net and .ws But if I need to know more! If you would simply like to discuss your domain name needs or find out more information, then email us by clicking here <mailto:4service(a)domainz.net.nz?subject=Information Please> . You can also ring us on 0800 366 2469 or visit our website, www.domainz.net.nz <http://www.domainz.net.nz/> . We'd like to join you in doing nothing... but we're busy. Because we value your business, doing nothing isn't an option for us. We're busy working on new and better ways to make managing your domain name easier and more cost effective! Thanks for registering your domain name with us. We intend to keep making it worth your while - to do nothing at all. Derek Locke and the team at Domainz To unsubscribe from future emails of this nature from Domainz, click here <mailto:noemail(a)domainz.net.nz?subject=Email Unsubscribe - '61717200'> . ----- End forwarded message ----- ------------------------------------------------- This mail sent through IMP: http://horde.org/imp/

10 9

Re: [nznog] Mae-West Looking Glass
by Jamie Baddeley 21 Jul '03

21 Jul '03

MIA. Last seen in action september 2002. http://web.archive.org/web/*/http://nitrous.digex.net probably assimilated by the borg. jamie >>> "Mark Frater" <mfrater(a)quicksilver.co.nz> 07/21 12:37 PM >>> What ever happened to nitrous.digex.net? Mark _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

3 2

Mae-West Looking Glass
by Mark Frater 20 Jul '03

20 Jul '03

What ever happened to nitrous.digex.net? Mark

2 1

Performance issues on Citylink yesterday (Saturday Jul 19)
by Simon Blake 19 Jul '03

19 Jul '03

Our apologies to the folks who suffered from performance problems on Citylink yesterday (Saturday). They were caused by an ISP under apparent SYN attack - not in itself a particularly unusual occurence, what was interesting was that in changes on Saturday morning (about 3am) said ISP managed to make the IP address under attack an unfiltered broadcast address on Citylink, so we all got to share the pain of a kind of combo SYN/smurf attack. The attacks manifested as 8-10Mb/s streams coming from the ISP onto Citylink for 1-4 minutes, about twice every two hours, which in turn caused some 10Mb customers on Citylink some disruption of service - 100Mb/1Gb customers seemed to be largely unaffected. The short duration and occasional nature of the problem did cause a few issues with tracking it and getting a resolution (about 9pm last night) - again, our apologies for not getting it sorted faster. Cheers Si

1 0

exploits logged in Auckland
by Joe Abley 17 Jul '03

17 Jul '03

I have seen attempts to exploit the recently-announced cisco vuln on a router of my acquaintance in Auckland, starting early this morning NZST. This confirms the notes on nanog (and in the updated cisco advisory) about functional exploits being published and used in the wild. The source addresses appear spoofed, and so far all of the hits have been received from outside NZ. The address "x.x.x.114" (see below) isn't in use on a router or anywhere else. Presumably the k1dd13z will realise at some point that there is more dead air on the Internet than ciscos, and will start harvesting victim addresses from traceroute instead of choosing them randomly. Is anybody contemplating customer-facing filters which block protocols 53, 54, 77 and 103? Jul 19 01:26:52 router 3587: Jul 19 01:22:37 NZST: %SEC-6-IPACCESSLOGNP: list 127 denied 54 216.191.222.139 (FastEthernet0/1.500 0002.xxxx.xxxx) -> x.x.x.164, 1 packet Jul 19 01:38:27 router 5320: Jul 19 01:34:12 NZST: %SEC-6-IPACCESSLOGNP: list 127 denied 53 245.128.83.9 (Serial2/2.1 DLCI xxx) -> x.x.x.114, 1 packet Jul 19 01:38:27 router 5321: Jul 19 01:34:13 NZST: %SEC-6-IPACCESSLOGRP: list 127 denied pim 216.225.202.10 (Serial2/2.1 DLCI xxx) -> x.x.x.114, 1 packet Jul 19 01:41:38 router 5327: .Jul 19 01:37:23 NZST: %SEC-6-IPACCESSLOGNP: list 127 denied 77 157.160.104.37 (Serial2/2.1 DLCI xxx) -> x.x.x.114, 1 packet Jul 19 01:42:02 router 5331: .Jul 19 01:37:47 NZST: %SEC-6-IPACCESSLOGNP: list 127 denied 55 222.21.158.112 (Serial2/2.1 DLCI xxx) -> x.x.x.114, 1 packet Jul 19 01:46:06 router 5343: .Jul 19 01:41:51 NZST: %SEC-6-IPACCESSLOGNP: list 127 denied 55 221.44.200.77 (Serial2/2.1 DLCI xxx) -> x.x.x.114, 1 packet Jul 19 01:46:06 router 5344: .Jul 19 01:41:51 NZST: %SEC-6-IPACCESSLOGRP: list 127 denied pim 148.246.222.60 (Serial2/2.1 DLCI xxx) -> x.x.x.114, 1 packet Jul 19 01:48:25 router 5347: .Jul 19 01:44:10 NZST: %SEC-6-IPACCESSLOGNP: list 127 denied 55 159.136.236.96 (Serial2/2.1 DLCI xxx) -> x.x.x.114, 1 packet Jul 19 01:48:25 router 5348: .Jul 19 01:44:10 NZST: %SEC-6-IPACCESSLOGRP: list 127 denied pim 151.142.170.98 (Serial2/2.1 DLCI xxx) -> x.x.x.114, 1 packet Jul 19 01:51:02 router 5353: Jul 19 01:46:48 NZST: %SEC-6-IPACCESSLOGNP: list 127 denied 53 172.75.88.52 (Serial2/2.1 DLCI xxx) -> x.x.x.114, 1 packet Jul 19 01:51:02 router 5354: Jul 19 01:46:48 NZST: %SEC-6-IPACCESSLOGRP: list 127 denied pim 146.95.71.5 (Serial2/2.1 DLCI xxx) -> x.x.x.114, 1 packet Jul 19 01:52:17 router 5359: Jul 19 01:48:02 NZST: %SEC-6-IPACCESSLOGNP: list 127 denied 53 252.40.243.114 (Serial2/2.1 DLCI xxx) -> x.x.x.114, 1 packet Jul 19 01:52:17 router 5360: Jul 19 01:48:02 NZST: %SEC-6-IPACCESSLOGRP: list 127 denied pim 151.94.44.88 (Serial2/2.1 DLCI xxx) -> x.x.x.114, 1 packet Jul 19 01:52:35 router 5362: Jul 19 01:48:20 NZST: %SEC-6-IPACCESSLOGNP: list 127 denied 53 24.17.251.39 (Serial2/2.1 DLCI xxx) -> x.x.x.114, 1 packet

1 0

Cisco Security Advisory: Cisco IOS Interface Blocked by IPv4 Packet
by Rob Thomas 17 Jul '03

17 Jul '03

FYI. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty); -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco IOS Interface Blocked by IPv4 Packet Revision 1.3 ============ Last Updated 2003 July 17 at 23:00 UTC (GMT) For Public Release 2003 July 17 at 6:10 UTC (GMT) ================= - ---------------------------------------------------------------------- Please provide your feedback on this document. - ---------------------------------------------------------------------- Contents ======== Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice: INTERIM Distribution Revision History Cisco Security Procedures - ---------------------------------------------------------------------- Summary ======= Cisco routers and switches running Cisco IOS� software and configured to process Internet Protocol version 4 (IPv4) packets are vulnerable to a Denial of Service (DoS) attack. A rare sequence of crafted IPv4 packets with specific protocol fields sent directly to the device may cause the input interface to stop processing traffic once the input queue is full. No authentication is required to process the inbound packet. Processing of IPv4 packets is enabled by default. Devices running only IP version 6 (IPv6) are not affected. A workaround is available. Cisco has made software available, free of charge, to correct the problem. This advisory is available at http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml. Affected Products ================= This issue affects all Cisco devices running Cisco IOS software and configured to process Internet Protocol version 4 (IPv4) packets. Cisco devices which do not run Cisco IOS software are not affected. Devices which run only Internet Protocol version 6 (IPv6) are not affected. Details ======= Cisco routers are configured to process and accept Internet Protocol version 4 (IPv4) packets by default. A rare, specially crafted sequence of IPv4 packets with protocol type 53 (SWIPE), 55 (IP Mobility), 77 (Sun ND), or 103 (Protocol Independent Multicast - PIM) which is handled by the processor on a Cisco IOS device may force the device to incorrectly flag the input queue on an interface as full, which will cause the router to stop processing inbound traffic on that interface. This can cause routing protocols to drop due to dead timers. Interfaces which are explicitly configured to run PIM will not be affected by traffic with protocol type 103. An interface with PIM enabled will have one of the following three commands in the interface configuration: ip pim dense-mode, ip pim sparse-mode, or ip pim sparse-dense-mode. On Ethernet interfaces, Address Resolution Protocol (ARP) times out after a default time of four hours, and no traffic can be processed. The device must be rebooted to clear the input queue on the interface, and will not reload without user intervention. The attack may be repeated on all interfaces causing the router to be remotely inaccessible. A workaround is available, and is documented in the Workarounds section. The following two Cisco vulnerabilities are documented in DDTS: CSCea02355 ( registered customers only) affects all Cisco routers running Cisco IOS software. This documents the flaw with protocols 53, 55, and 77. CSCdz71127 ( registered customers only) was introduced by an earlier code revision, and documents an input queue vulnerability to protocol 103 with a device which is not configured for PIM. Any version of software which has the fix for CSCdx02283 ( registered customers only) is vulnerable. Registered customers can find more details using the Bug Toolkit at http://www.cisco.com/cgi-bin/Support/Bugtool/launch_bugtool.pl ( registered customers only) . To identify a blocked input interface, use the show interfaces command and look for the Input Queue line. If the current size (in this case, 76) is larger than the maximum size (75), the input queue is blocked. Use the show buffers command and look for the prot field. Below are two examples: Router#show interface ethernet 0/0 Ethernet0/0 is up, line protocol is up Hardware is AmdP2, address is 0050.500e.f1e0 (bia 0050.500e.f1e0) Internet address is 172.16.1.9/24 MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, rely 255/255, load 1/255 Encapsulation ARPA, loopback not set, keepalive set (10 sec) ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:41, output 00:00:07, output hang never Last clearing of "show interface" counters 00:07:18 Input queue: 76/75/1091/0 (size/max/drops/flushes); Total output drops: 0 !--- The 76/75 shows that this is blocked Router#show buffers input-interface serial 0/0 Buffer information for Small buffer at 0x612EAF3C data_area 0x7896E84, refcount 1, next 0x0, flags 0x0 linktype 7 (IP), enctype 0 (None), encsize 46, rxtype 0 if_input 0x6159D340 (FastEthernet3/2), if_output 0x0 (None) inputtime 0x0, outputtime 0x0, oqnumber 65535 datagramstart 0x7896ED8, datagramsize 728, maximum size 65436 mac_start 0x7896ED8, addr_start 0x7896ED8, info_start 0x0 network_start 0x7896ED8, transport_start 0x0 source: 212.176.72.138, destination: 212.111.64.174, id: 0xAAB8, ttl: 41, prot: 103 !--- prot: 103 is proof that this is one of the attack packets Impact ====== A device receiving these specifically crafted IPv4 packets will force the inbound interface to stop processing traffic. The device may stop processing packets destined to the router, including routing protocol packets and ARP packets. No alarms will be triggered, nor will the router reload to correct itself. This issue can affect all Cisco devices running Cisco IOS software. This vulnerability may be exercised repeatedly resulting in loss of availability until a workaround has been applied or the device has been upgraded to a fixed version of code. Software Versions and Fixes =========================== Each row of the table describes a release train and the platforms or products for which it is intended. If a given release train is vulnerable, then the earliest possible releases that contain the fix and the anticipated date of availability for each are listed in the Rebuild, Interim, and Maintenance columns. In some cases, no rebuild of a particular release is planned; this is marked with the label "Not scheduled." A device running any release in the given train that is earlier than the release in a specific column (less than the earliest fixed release) is known to be vulnerable, and it should be upgraded at least to the indicated release or a later version (greater than the earliest fixed release label). When selecting a release, keep in mind the following definitions: * Maintenance Most heavily tested and highly recommended release of any label in a given row of the table. * Rebuild Constructed from the previous maintenance or major release in the same train, it contains the fix for a specific vulnerability. Although it receives less testing, it contains only the minimal changes necessary to effect the repair. Cisco has made available several rebuilds of mainline trains to address this vulnerability, but strongly recommends running only the latest maintenance release on mainline trains. * Interim Built at regular intervals between maintenance releases and receives less testing. Interims should be selected only if there is no other suitable release that addresses the vulnerability, and interim images should be upgraded to the next available maintenance release as soon as possible. Interim releases are not available through manufacturing, and usually they are not available for customer download from CCO without prior arrangement with the Cisco Technical Assistance Center (TAC). In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco TAC for assistance, as shown in the section following this table. +--------------------------------------------------------------------+ |Train |Description of |Availability of Fixed Releases | | |Image or Platform | | |--------------------------+-----------------------------------------+ | 11.x based releases | Rebuild |Interim| Maintenance | |--------------------------+-----------+-------+---------------------+ |11.1CA| |11.1(36)CA4| | | | | |** | | | |------+-------------------+-----------+-------+---------------------+ |11.2 | |11.2(26e)**| | | |------+-------------------+-----------+-------+---------------------+ |11.2P | |11.2(26)P5*| | | | | |* | | | |------+-------------------+-----------------------------------------+ |11.3 | |Not scheduled | |------+-------------------+-----------------------------------------+ |11.3T | |Not scheduled | |--------------------------+-----------------------------------------+ |12.0 based releases |Rebuild |Interim|Maintenance | |--------------------------+-----------+-------+---------------------+ | |General Deployment | | | | |12.0 |release for all | | |12.0(26) | | |platforms | | | | |------+-------------------+-----------------------------------------+ |12.0DA|xDSL support: 6100,|Migrate to 12.2DA; 12.2(10)DA2 - | | |6200 |Aug-15-2003, 12.2(12)DA3 - Aug-22-2003: | | | |Engineering Specials available on | | | |request. | |------+-------------------+-----------------------------------------+ |12.0DB|Early Deployment |Migrate to 12.3(1a) | | |6400 UAC for NSP | | |------+-------------------+-----------------------------------------+ |12.0DC|Early Deployment |Migrate to 12.3(1a) | | |6400 UAC for NRP | | |------+-------------------+-----------------------------------------+ | | |12.0(24)S2 | | | | | |12.0(23)S3 | | | | | |12.0(22)S5 | | | | | |12.0(21)S7 | | | | | |12.0(19)S4 | | | | |Core/ISP support: |12.0(18)S7 | | | |12.0S |GSR, RSP, c7200, |12.0(17)S7 | |12.0(25)S | | |c10k |12.0(16)S10| | | | | |12.0(15)S7 | | | | | |12.0(14)S8 | | | | | |12.0(13)S8 | | | | | |12.0(12)S4 | | | | | |12.0(10)S8 | | | |------+-------------------+-----------------------------------------+ |12.0SC|Cable/broadband |Migrate to 12.1(19)EC | | |ISP: ubr7200 | | |------+-------------------+-----------------------------------------+ |12.0SL|100000 ESR:c10k |Migrate to 12.0(23)S3, **12.0(17)SL9 - | | | |Jul-15-2003 | |------+-------------------+-----------------------------------------+ |12.0SP|Early Deployment |Migrate to 12.0(22)S5 | |------+-------------------+-----------------------------------------+ | |Early Deployment |12.0(21)ST7| | | |12.0ST|release for Core/ |12.0(20)ST6| | | | |ISP support: GSR, |12.0(19)ST6| | | | |RSP, c7200 |12.0(17)ST8| | | |------+-------------------+-----------------------------------------+ |12.0SX|Early Deployment |Migrate to 12.0(22)S5 | |------+-------------------+-----------------------------------------+ |12.0SY|Early Deployment |Migrate to 12.0(23)S3 | |------+-------------------+-----------------------------------------+ |12.0SZ|Early Deployment |Migrate to 12.0(23)S3 | |------+-------------------+-----------------------------------------+ |12.0T |Early Deployment |12.0(7)T3**| | | |------+-------------------+-----------+-------+---------------------+ | |8510c, ls1010, | | |12.0(26)W5(28) | | |cat8540c,cat8540m, | | | | | |ls1010 | | | | | |-------------------+-----------+-------+---------------------+ | |c5atm |12.0(26)W5 | | | | | |(28a) | | | | |-------------------+-----------+-------+---------------------+ | |Cat4232 and |12.0(25)W5 | | | |12.0W5|Cat2948G-L3 |(27) | | | | |-------------------+-----------+-------+---------------------+ | |C6MSM |Engineering| | | | | |Special | | | | | |available | | | | | |on request | | | | |-------------------+-----------+-------+---------------------+ | |c5rsfc,c5rsm,C3620,| | |12.1(20) | | |C3640, C4500, | | | | | |C7200, RSP | | | | |------+-------------------+-----------+-------+---------------------+ |12.0WC|Early deployment |12.0(05)WC8| | | | |2900XL-LRE,2900XL/ | | | | | |3500XL; 2950 | | | | | |release | | | | |------+-------------------+-----------+-------+---------------------+ |12.0WT|Early deployment |Engineering| | | | |Catalyst switches: |Special | | | | |cat4840g, |Available | | | | | |upon | | | | | |request | | | |------+-------------------+-----------------------------------------+ |12.0X |Shortlived Early |All 12.0X(any letter) releases have | |(l) |Deployment Releases|migrated to either 12.0T or 12.1 unless | | | |otherwise documented in the X release | | | |technical notes pertaining to the | | | |specific release. Please check migration | | | |paths for all 12.0X releases. | |--------------------------+-----------------------------------------+ |12.1 based releases |Rebuild |Interim|Maintenance | |--------------------------+-----------+-------+---------------------+ | |General Deployment | |12.1 | | |12.1 |release for all | |(18.4) |12.1(19) | | |platforms | | | | |------+-------------------+-----------------------------------------+ |12.1AA| |Migrate to 12.2 | |------+-------------------+-----------------------------------------+ |12.1AX|Catalyst 3750 |12.1(14)EA1| | | | | |- | | | | | |Engineering| | | | | |special | | | | | |available | | | | | |upon | | | | | |request | | | |------+-------------------+-----------+-------+---------------------+ |12.1AY|Catalyst 2940 | | |12.1(13)AY | |------+-------------------+-----------------------------------------+ |12.1DA|6160 platform |Migrate to 12.2DA | |------+-------------------+-----------------------------------------+ |12.1DB|6400 UAC |Migrate to 12.3(1a) | |------+-------------------+-----------------------------------------+ |12.1DC|6400 UAC |Migrate to 12.3(1a) | |------+-------------------+-----------------------------------------+ |12.1E |Core Enterprise |12.1(8b)E14| |12.1(19)E | | |support - c7200, |12.1(13)E7 | | | | |Catalyst 6000, RSP |12.1(14)E4 | | | | | |**12.1(12c)| | | | | |E7 | | | | | |12.1(11b) | | | | | |E12- | | | | | |Aug-4-2003 | | | | | |12.1(6)E12 | | | |------+-------------------+-----------------------------------------+ |12.1EA|12.1(4)EA |Migrate to 12.1(13)EA1c | | |12.1(6)EA | | | |12.1(8)EA | | | |12.1(9)EA | | | |12.1(11)EA | | | |-------------------+-----------------------------------------+ | |12.1(12c)EA |12.1(13) | | | | |12.1(13)EA |EA1c | | | |------+-------------------+-----------+-------+---------------------+ |12.1EB|LS1010 | | |12.1(14)EB | |------+-------------------+-----------+-------+---------------------+ |12.1EC|Early Deployment | | |12.1(19)EC (scheduled| | | | | |last week of July) | |------+-------------------+-----------+-------+---------------------+ |12.1EV|Early Deployment | | |12.1(12c)EV | |------+-------------------+-----------+-------+---------------------+ |12.1EW|Early Deployment | | |12.1(13)EW,12.1(19)EW| | |Cat4000 L3 | | | | |------+-------------------+-----------+-------+---------------------+ |12.1EX|Early deployment |12.1(13)EX2| | | |------+-------------------+-----------+-------+---------------------+ |12.1EY| | |12.1(14)E4 | | | |------+---------+---------+-----------+-------+---------------------+ | | | |12.1(14)EA1| | | |12.1YJ| | |- | | | | | | |Jul-28-2003| | | |------+-------------------+-----------+-------+---------------------+ |12.1T |Early deployment |12.1(5)T15*| | | | | |* | | | |------+-------------------------------------------------------------+ |12.1X |12.1X releases generally migrate to 12.1T, 12.2 or 12.2T as | |(l) |specified below. Please refer to specific train Technical | | |notes for documented migration path. | |------+-------------------------------------------------------------+ |12.1XA|Short lived Early |Migrate to 12.1(5)T15 | | |Deployment Release | | |------+-------------------+-----------------------------------------+ |12.1XC|Short lived Early |Migrate to12.2(17) | |12.1XD|Deployment Releases| | |12.1XH| | | |12.1XI| | | |------+-------------------+-----------------------------------------+ |12.1XB|Short lived Early |Migrate to 12.2(15)T5 | |12.1XF|Deployment Releases| | |12.1XG| | | |12.1XJ| | | |12.1XL| | | |12.1XP| | | |12.1XR| | | |12.1XT| | | |12.1YB| | | |12.1YC| | | |12.1YD| | | |12.1YH| | | |------+-------------------+-----------------------------------------+ |12.1XM|Short lived Early |Migrate to 12.2(2)XB11 | |12.1XQ|Deployment Releases| | |12.1XV| | | |------+-------------------+-----------------------------------------+ |12.1XU|Short lived Early |Migrate to 12.2(4)T6 | | |Deployment Release | | |------+-------------------+-----------------------------------------+ |12.1YE|Short lived Early |Migrate to 12.2(2)YC | |12.1YF|Deployment Release | | |12.1YI| | | |--------------------------+-----------------------------------------+ |12.2 based releases |Rebuild |Interim|Maintenance | |--------------------------+-----------+-------+---------------------+ | |General Deployment |12.2(16a) | | | |12.2 |(GD) candidate for |12.2(12e) | |12.2(17) | | |all platforms |12.2(10d) | | | |------+-------------------+-----------+-------+---------------------+ |12.2B |12.2(2)B-12.2(4)B7 |12.3(1a) | | | | |-------------------+-----------+-------+---------------------+ | |12.2(4)B8-12.2(16)B|12.2(16)B1 | | | |------+-------------------+-----------+-------+---------------------+ |12.2BC|Early Deployment |12.2(15)BC1| | | | |Release |(Scheduled | | | | | |end of | | | | | |July) | | | |------+-------------------+-----------+-------+---------------------+ |12.2BW|Early Deployment |Migrate to | | | | |for use with 7200, |12.3(1a) | | | | |7400, and 7411 | | | | | |platforms | | | | |------+-------------------+-----------+-------+---------------------+ |12.2BX|Broadband/Leased | | |12.2(16)BX | | |line | | | | |------+-------------------+-----------+-------+---------------------+ |12.2BZ|Early Deployment |12.2(15)BZ1| | | | |Release | | | | |------+-------------------+-----------------------------------------+ |12.2CX|Early Deployment |Migrate to 12.1(15)BC1 | | |Release | | |------+-------------------+-----------------------------------------+ |12.2CY|Early Deployment |Migrate to 12.1(15)BC1 | | |Release | | |------+-------------------+-----------------------------------------+ |12.2DA|Early Deployment |12.2(10)DA2| | | | |Release |- | | | | | |Jul-15-2003| | | | | |12.2(12)DA3| | | | | |- | | | | | |Aug-22-2003| | | | | |Enginering | | | | | |Special | | | | | |available | | | | | |on request | | | |------+-------------------+-----------------------------------------+ |12.2DD|Early Deployment |Migrate to 12.3(1a) | | |Release | | |------+-------------------+-----------------------------------------+ |12.2DX|Early Deployment |Migrate to 12.3(1a) | | |Release | | |------+-------------------+-----------------------------------------+ |12.2JA|Cisco Aironet | | |12.2(11)JA | | |hardware platforms:| | | | | |Introduction of | | | | | |Access Point | | | | | |feature in IOS, | | | | | |Cisco 1100 Series | | | | | |Access Point | | | | | |(802.11b) | | | | |------+-------------------+-----------+-------+---------------------+ |12.2MB|Specific Technology|12.2(4)MB12| | | | |ED for 2600 7500 | | | | | |(GPRS/PDSN/GGSN | | | | | |2600/7200/7500) | | | | |------+-------------------+-----------+-------+---------------------+ |12.2MC|Early Deployment: |12.2(13)MC1| | | | |IP RAN |CCO: 7/24/ | | | | | |03 | | | |------+-------------------+-----------+-------+---------------------+ |12.2MX| |12.2(8)YD | | | | | | | | | |------+-------------------+-----------+-------+---------------------+ |12.2S |Core/ISP support: |12.2(14)S1 |12.2 | | | |GSR, RSP, c7200 | |(16.5)S| | |------+-------------------+-----------+-------+---------------------+ |12.2SX|IOS Support for |12.2(14)SX1| | | | |C6500 Supervisor 3 | | | | |------+-------------------+-----------+-------+---------------------+ |12.2SY|VPN feature release|12.2(14) | | | | |for c6k/76xx VPN |SY1, 12.2 | | | | |service module. |(8)YD | | | |------+-------------------+-----------+-------+---------------------+ |12.2SZ|7304 Platform |12.2(14)SZ2| | | |------+-------------------+-----------+-------+---------------------+ | | |12.2(15)T4/| |No more maintenance | | |New Technology |5,12.2(13) | |trains for 12.2T are | | |Early Deployment |T5, |12.2 |planned, please | |12.2T |(ED) release for |12.2(11) |(16.5)T|migrate to latest | | |all platforms |T9,12.2(8) | |12.3 Mainline | | | |T10, | |release. | | | |12.2(4)T6 | | | |------+-------------------+-----------------------------------------+ |12.2X |Short lived Early |Many short lived releases migrate to the | |(l) |Deployment Releases|same train; the trains below this point | |12.2Y |- |until the following section are not | |(l) | |grouped by strict alphabetical order, but| | | |are grouped by migration path. Please | | | |review documented migration paths for | | | |your trains. | |------+-------------------+-----------------------------------------+ |12.2XA|Short lived Early |Migrate to 12.2(11)T9 | | |Deployment Releases| | |------+-------------------+-----------------------------------------+ |12.2XS| |12.2(2)XB11 | |------+-------------------+-----------------------------------------+ |12.2XD|Short lived Early |Migrate to 12.2(15)T5 | |12.2XE|Deployment Releases| | |12.2XH| | | |12.2XI| | | |12.2XJ| | | |12.2XK| | | |12.2XL| | | |12.2XM| | | |12.2XQ| | | |12.2XU| | | |12.2XW| | | |12.2YA| | | |12.2YB| | | |12.2YC| | | |12.2YF| | | |12.2YG| | | |12.2YH| | | |12.2YJ| | | |12.2YT| | | |------+-------------------+-----------------------------------------+ |12.2YN|Short lived Early |Migrate to 12.2(13)ZH | | |Deployment Releases| | |------+-------------------+-----------------------------------------+ | |Short lived Early |Migrate to 12.2(14)SY1 available | |12.2YO|Deployment Releases|Aug-4-2003: Engineering Special | | | |available on request | |------+-------------------+-----------------------------------------+ | |Early Deployment | | | | |12.2XB|Release with |12.2(2)XB11| | | | |continuing support | | | | |------+-------------------+-----------------------------------------+ |12.2XC|Short lived Early |Migrate to 12.2(16)B1 | | |Deployment Releases| | |------+-------------------+-----------------------------------------+ |12.2XF|Short lived Early |Migrate to 12.2(15)BC1 | | |Deployment Release | | | |UBR10000 | | |------+-------------------+-----------------------------------------+ |12.2XG|Short lived Early |Migrate to 12.2(8)T10 | | |Deployment Release | | |------+-------------------+-----------------------------------------+ |12.2XN|Short lived Early |Migrate to 12.2(11)T9 | |12.2XT|Deployment Releases| | |------+-------------------+-----------------------------------------+ |12.2YD|Short lived Early |Migrate to 12.2(8)YY | | |Deployment Release | | |------+-------------------+-----------------------------------------+ |12.2YP|Short lived Early |**12.2(11) | | | | |Deployment Release |YP1 | | | |------+-------------------+-----------------------------------------+ |12.2YK| |Migrate to 12.2(13)ZC | |------+-------------------+-----------------------------------------+ |12.2YL|Short lived Early |Migrate to 12.2(13)ZH | |12.2YM|Deployment Releases| | |12.2YU| | | |12.2YV| | | |------+-------------------+-----------------------------------------+ |12.2YQ|Short lived Early |Migrate to 12.2(15)ZL | |12.2YR|Deployment Releases| | |------+-------------------+-----------------------------------------+ |12.2YS|Short lived Early |12.2(15)YS/| | | | |Deployment Release |1.2(1) | | | |------+-------------------+-----------+-------+---------------------+ |12.2YW|Short lived Early |12.2(8)YW2 | | | | |Deployment Releases| | | | |------+-------------------+-----------+-------+---------------------+ |12.2YX|Short lived Early |12.2(11)YX1| | | | |Deployment Release | | | | | |Crypto for 7100/ | | | | | |7200 | | | | |------+-------------------+-----------+-------+---------------------+ |12.2YY|Short lived Early |12.2(8)YY3 | | | | |Deployment Releases| | | | | |IOS support for | | | | | |General Packet | | | | | |Radio Service | | | | |------+-------------------+-----------+-------+---------------------+ |12.2YZ|Short lived Early |12.2(11)YZ2| | | | |Deployment Release | | | | |------+-------------------+-----------+-------+---------------------+ |12.2ZA|Short lived Early | | |12.2(14)ZA2 | | |Deployment Release | | | | |------+-------------------+-----------+-------+---------------------+ |12.2ZB|Short lived Early |12.2(8)ZB7 | | | | |Deployment Release | | | | |------+-------------------+-----------+-------+---------------------+ |12.2ZC|Short lived Early | | |12.2(13)ZC | | |Deployment Release | | | | |------+-------------------+-----------+-------+---------------------+ |12.2ZD|Short lived Early |Not | | | | |Deployment Release |Scheduled | | | |------+-------------------+-----------+-------+---------------------+ |12.2ZE|Short lived Early |12.3(1a) | | | | |Deployment Release | | | | |------+-------------------+-----------+-------+---------------------+ |12.2ZF|Short lived Early |Not | | | | |Deployment Release |Vulnerable | | | |------+-------------------+-----------+-------+---------------------+ |12.2ZG|Short lived Early |Not | | | | |Deployment Release |Vulnerable | | | |------+-------------------+-----------+-------+---------------------+ |12.2ZH|Short lived Early |Not | | | | |Deployment Release |Vulnerable | | | |------+-------------------+-----------+-------+---------------------+ |12.2ZJ|Short lived Early |12.2(15)ZJ1| | | | |Deployment Release | | | | |------+-------------------+-----------+-------+---------------------+ |12.2ZL|Short lived Early |Not | | | | |Deployment Release |Vulnerable | | | |--------------------------+-----------------------------------------+ |12.3 based releases |NOT VULNERABLE | |--------------------------------------------------------------------+ |Notes: **Marked versions of code are not available on CCO. Please | |contact TAC and request the specific images you need posted. | +--------------------------------------------------------------------+ Notes: ** Marked versions of code are not available on CCO. Please contact the Cisco TAC and request the specific images you need posted. Obtaining Fixed Software ======================== Customers with contracts should obtain upgraded software free of charge through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on the Cisco worldwide website at http://www.cisco.com/tacpage/sw-center/sw-ios.shtml. Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with obtaining the free software upgrade(s). Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Please have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Please do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades. See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers, instructions, and e-mail addresses for use in various languages. Workarounds =========== AFTER APPLYING THE WORKAROUND the input queue depth may be raised with the hold-queue <new value> in interface command -- the default size is 75. This will allow traffic flow on the interface until the device can be reloaded. Cisco recommends that all IOS devices which process IPv4 packets be configured to block traffic directed to the router from any unauthorized source with the use of Access Control Lists (ACLs). This can be done at multiple locations, and it is recommended that you review all methods and use the combination which fits your network best. Legitimate traffic is defined as management protocols such as telnet, snmp or ssh, and configured routing protocols from explicitly allowed peers. All other traffic destined to the device should be blocked at the input interface. Traffic entering the network should also be carefully evaluated and filtered at the network edge if destined to an infrastructure device. Although network service providers must often allow unknown traffic to transit their network, it is not necessary to allow that same traffic destined to their network infrastructure. Several white papers have been written to assist in deploying these recommended security best practices. ACLs can have performance impact on certain platforms, so care should be taken when applying the recommended workarounds. Transit ACLs The following access list is specifically designed to block attack traffic. Note that the attack traffic can include spoofed source addresses. This access list should be applied to all interfaces of the device, and should include topology-specific filters. This could include filtering routing protocol traffic, management protocols, and traffic destined for the internal network. Protocol 103 is Protocol Independent Multicast (PIM), which is a commonly deployed application in multicast networks. Interfaces with PIM enabled have not been found to be vulnerable to exploit traffic with protocol 103; PIM traffic may be permitted to those select devices. access-list 101 deny 53 any any access-list 101 deny 55 any any access-list 101 deny 77 any any access-list 101 deny 103 any any !--- insert any other previously applied ACL entries here !--- you must permit other protocols through to allow normal !--- traffic -- previously defined permit lists will work !--- or you may use the permit ip any any shown here access-list 101 permit ip any any Prior to deploying ACLs that filter transit traffic, a classification ACL can be used to help identify required permit statements. A classification ACL is an ACL that permits a series of protocols. Displaying access-list entry hit counters helps determine required protocols: entries with zero packets counted are likely not required. Classification access-lists are detailed in the link below for infrastructure access-lists. Receive ACLs For distributed platforms, receive path access lists may be an option starting in Cisco IOS Software Versions 12.0(21)S2 for the c12000 and 12.0(24)S for the c7500. The receive access lists protect the device from harmful traffic before the traffic can impact the route processor. The CPU load is distributed to the line card processors and helps mitigate load on the main route processor. The white paper entitled "GSR: Receive Access Control Lists" will help you identify and allow legitimate traffic to your device and deny all unwanted packets: http://www.cisco.com/warp/customer/707/racl.html Infrastructure ACLs Although it is often difficult to block traffic transiting your network, it is possible to identify traffic which should never be allowed to target your infrastructure devices and block that traffic at the border of your network. The white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection ACLs: http://www.cisco.com/warp/customer/707/iacl.html Exploitation and Public Announcements ===================================== Since the initial posting of this document, the Cisco PSIRT has been made aware of public announcements of the vulnerabilities described in this advisory. PSIRT has chosen to resend to our standard distribution list immediately with further details to assist network administrators in mitigation. Status of This Notice: INTERIM ============================== This is an INTERIM notice. Although Cisco cannot guarantee the accuracy of all statements in this notice, all of the facts have been checked to the best of our ability. Cisco does not anticipate issuing updated versions of this advisory unless there is some material change in the facts. Should there be a significant change in the facts, Cisco will update this advisory. Distribution ============ This notice is posted on the Cisco worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml. In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients at the public release date and time: * cust-security-announce(a)cisco.com * bugtraq(a)securityfocus.com * full-disclosure(a)lists.netsys.com * first-teams(a)first.org (includes CERT/CC) * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * nanog(a)merit.edu * sanog(a)sanog.org * comp.dcom.sys.cisco * Various internal Cisco mailing lists Future updates of this advisory, if any, will be placed on the Cisco worldwide web server. Users concerned about this problem are encouraged to check the URL given above for any updates. Revision History ================ +-------------------------------------------+ | Revision | 17-July-2003 | Initial public | | 1.0 | 0:00 GMT | release | |----------+--------------+-----------------| | | | Updated | | | | Workaround | | Revision | 17-July-2003 | section (access | | 1.1 | 6:10 GMT | lists), Updated | | | | table with | | | | information on | | | | 12.0W5 | |----------+--------------+-----------------| | | | Corrected "Last | | | | Updated" time; | | | | corrected | | Revision | 17-July-2003 | document title | | 1.2 | 10:30 GMT | of | | | | Infrastructure | | | | ACL link under | | | | Workaround | | | | section | |----------+--------------+-----------------| | | | Added "with | | | | specific | | | | protocol | | | | fields" in | | | | Summary | | | | section; | | | | updated Details | | | | section to | | | | include | | | | protocol types; | | | | added details | | Revision | 17-July-2003 | to the Cisco | | 1.3 | 23:00 GMT | vulnerabilities | | | | paragraph; | | | | added an output | | | | example to | | | | identify an | | | | attack packet; | | | | rewrote Transit | | | | ACLs section; | | | | updated | | | | Exploitation | | | | and Public | | | | Announcements | | | | paragraph | +-------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on the Cisco worldwide website at http://www.cisco.com/warp/public/707/sec_incident_response.shtml. This includes instructions for press inquiries regarding Cisco security notices. All Cisco Security Advisories are available at http://www.cisco.com/go/psirt. - ---------------------------------------------------------------------- This notice is Copyright 2003 by Cisco Systems, Inc. This notice may be redistributed freely after the release date given at the top of the text, provided that redistributed copies are complete and unmodified, and include all date and version information. - ---------------------------------------------------------------------- Toolbar ======= All contents are Copyright � 1992-2003 Cisco Systems, Inc. All rights reserved. -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.2 iQA/AwUBPxchOXsxqM8ytrWQEQLgzwCeMBqiamX2K/VvMhIgooz9d11K1VoAoLcF nmN6hA5ZuyDFBhW3o+FydDop =pSyP -----END PGP SIGNATURE-----

2 1

IPv6
by Antonio Broughton 17 Jul '03

17 Jul '03

Hey, I was just looking through the archives of the list, and found a post that was about IPv6 peering in New Zealand. I am currently trying to setup a website (http://www.ipv6.co.nz) but as such, I am the only one involved :P. If anyone wants to help me setup content for the site etc, or if you would like to use the domain for such things as the domain for a New Zealand IPv6 Peer... then by allmeans... you can use it, just email me... Antonio Broughton

14 32

Fwd: Critical Vulnerability discovered in Windows Servers
by barry＠unix.co.nz 17 Jul '03

17 Jul '03

Don't know how many windows admins out there, but incase you havn't yet heard about the new windows RPC sploit, read below. ----- Forwarded message from Haroon Meer <haroon(a)sensepost.com> ----- Date: Fri, 18 Jul 2003 02:48:06 +0200 (SAST) From: Haroon Meer <haroon(a)sensepost.com> Reply-To: Haroon Meer <haroon(a)sensepost.com> Subject: Critical Vulnerability discovered in Windows Servers To: icepick(a)cybernett.co.za Dear Barry Murphy, Vulnerability in Microsoft Windows Servers. Versions Affected : Windows XP, Windows NT4, Windows2000, Windows2003 Severity of Bug : CRITICAL Port / Service : Port 135 - Microsoft RPC A Polish security research group have found a remotely exploitable bug in Windows based operating systems. The bug affects almost the entire Microsoft Product range from Windows NT4, to Windows2000 and even Windows2003. The exploit uses port 135 as its attack vector with the exploitable component being Microsoft RPC. This vulnerability should be considred "Critical" since it yields "SYSTEM" privileges on the victim machine. Microsoft have issued an advisory and a patch is available from them at the following location : http://www.microsoft.com/security/security_bulletins/ms03-026.asp The possible workarounds for the problem untill the patch is applied are to : [a] Firewall off access to port 135 [b] Disable DCOM on the server (Using Dcomcnfg.exe) While no exploit code for this vulnerability is currently reported in the wild, the problem aknowledged by Microsoft to be exploitable, meaning that Proof of Concept exploits (and possibly worms) will not be a long time coming. Full details on the exploit can be found at http://lsd-pl.net/special.html. Sincerely. ======================================================= SensePost Research research(a)sensepost.com http://www.sensepost.com (tel) +27 12 667 4737 ======================================================= ----- End forwarded message ----- ------------------------------------------------- This mail sent through IMP: http://horde.org/imp/

1 0

Peering at the APE and WIX
by Andy Linton 16 Jul '03

16 Jul '03

At the nznog meeting in Auckland last week I said I'd give details of how to apply for a connection once the new web pages were available and so here they are: http://www.citylink.co.nz/cgi-bin/wixape.pl?tmpl=ape.tmpl http://www.citylink.co.nz/cgi-bin/wixape.pl?tmpl=wix.tmpl You may also find the two Looking Glass pages, that give a view of what is happening on the APE and WIX route servers, useful: http://www.wix.net.nz/cgi-bin/mrlg-ape.cgi http://www.wix.net.nz/cgi-bin/mrlg-wix.cgi

1 0

IOS Vulnerability
by Arron Scott 16 Jul '03

16 Jul '03

As mentioned by Joe, Cisco has just announced a vulnerability that affects all versions of IOS, on any device, switches and routers. In the first instance, it is important to note that there are currently NO known exploitations of this vulnerability, and we are announcing it after building and preparing the appropriate fixes for all current platforms. Fixes have been made available regardless of whether your routers are under a maintentance support contract or not. The following URL also defines how to build Access-lists that can protect you from this vulnerability. http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml Do not panic, if you need more detail, feel free to give me a ring. If you can find an opportunity we would recommend an upgrade, but this is out of caution rather than need. Hope this helps to clarify the situation Arron Scott Cisco NZ *********************************************************************** Arron Scott (CCIE #4099) Phone: +64-9-3551951 Systems Engineer Mobile: +64-21-883163 Cisco New Zealand mailto:ascott(a)cisco.com http://www.cisco.com ***********************************************************************

1 0

upgrade your routers
by Joe Abley 16 Jul '03

16 Jul '03

forwarded from cisco, not from any other source Begin forwarded message: > From: Scott McGrath <mcgrath(a)fas.harvard.edu> > Date: Wed Jul 16, 2003 23:02:37 Canada/Eastern > To: nanog(a)merit.edu > Subject: IOS Vulnerability > > > > For full details about the vulnerability see > > http://www.cisco.com/en/US/products/hw/routers/ps341/ > products_security_advisory09186a00801a34c2.shtml > > Scott C. McGrath >

1 1

Cisco Security Advisory: Cisco IOS Interface Blocked by IPv4 Packet
by Cisco Systems Product Security Incident Response Team 16 Jul '03

16 Jul '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco IOS Interface Blocked by IPv4 Packet Revision 1.0 ============ For Public Release 2003 July 17 at 0:00 UTC (GMT) - -------------------------------------------------------------------------- Please provide your feedback on this document. - -------------------------------------------------------------------------- Contents ======== Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice: INTERIM Distribution Revision History Cisco Security Procedures - -------------------------------------------------------------------------- Summary ======= Cisco routers and switches running Cisco IOS® software and configured to process Internet Protocol version 4 (IPv4) packets are vulnerable to a Denial of Service (DoS) attack. A rare sequence of crafted IPv4 packets sent directly to the device may cause the input interface to stop processing traffic once the input queue is full. No authentication is required to process the inbound packet. Processing of IPv4 packets is enabled by default. Devices running only IP version 6 (IPv6) are not affected. A workaround is available. Cisco has made software available, free of charge, to correct the problem. This advisory is available at http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml. Affected Products ================= This issue affects all Cisco devices running Cisco IOS software and configured to process Internet Protocol version 4 (IPv4) packets. Cisco devices which do not run Cisco IOS software are not affected. Devices which run only Internet Protocol version 6 (IPv6) are not affected. Details ======= Cisco routers are configured to process and accept Internet Protocol version 4 (IPv4) packets by default. A rare, specially crafted sequence of IPv4 packets which is handled by the processor on a Cisco IOS device may force the device to incorrectly flag the input queue on an interface as full, which will cause the router to stop processing inbound traffic on that interface. This can cause routing protocols to drop due to dead timers. On Ethernet interfaces, Address Resolution Protocol (ARP) times out after a default time of four hours, and no traffic can be processed. The device must be rebooted to clear the input queue on the interface, and will not reload without user intervention. The attack may be repeated on all interfaces causing the router to be remotely inaccessible. A workaround is available, and is documented in the Workarounds section. The following two Cisco vulnerabilities are documented in DDTS. CSCea02355 ( registered customers only) affects all Cisco routers running Cisco IOS software. CSCdz71127 ( registered customers only) was introduced by an earlier code revision. Any version of software which has the fix for CSCdx02283 ( registered customers only) is vulnerable. Registered customers can find more details using the Bug Toolkit at http://www.cisco.com/cgi-bin/Support/Bugtool/launch_bugtool.pl ( registered customers only) . To identify a blocked input interface, use the show interfaces command and look for the Input Queue line. If the current size (in this case, 76) is larger than the maximum size (75), the input queue is blocked. Router#show interface ethernet 0/0 Ethernet0/0 is up, line protocol is up Hardware is AmdP2, address is 0050.500e.f1e0 (bia 0050.500e.f1e0) Internet address is 172.16.1.9/24 MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, rely 255/255, load 1/255 Encapsulation ARPA, loopback not set, keepalive set (10 sec) ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:41, output 00:00:07, output hang never Last clearing of "show interface" counters 00:07:18 Input queue: 76/75/1091/0 (size/max/drops/flushes); Total output drops: 0 ^^^^^^^^^^^^^^ ---> blocked Impact ====== A device receiving these specifically crafted IPv4 packets will force the inbound interface to stop processing traffic. The device may stop processing packets destined to the router, including routing protocol packets and ARP packets. No alarms will be triggered, nor will the router reload to correct itself. This issue can affect all Cisco devices running Cisco IOS software. This vulnerability may be exercised repeatedly resulting in loss of availability until a workaround has been applied or the device has been upgraded to a fixed version of code. Software Versions and Fixes =========================== Each row of the table describes a release train and the platforms or products for which it is intended. If a given release train is vulnerable, then the earliest possible releases that contain the fix and the anticipated date of availability for each are listed in the Rebuild, Interim, and Maintenance columns. In some cases, no rebuild of a particular release is planned; this is marked with the label "Not scheduled." A device running any release in the given train that is earlier than the release in a specific column (less than the earliest fixed release) is known to be vulnerable, and it should be upgraded at least to the indicated release or a later version (greater than the earliest fixed release label). When selecting a release, keep in mind the following definitions: * Maintenance Most heavily tested and highly recommended release of any label in a given row of the table. * Rebuild Constructed from the previous maintenance or major release in the same train, it contains the fix for a specific vulnerability. Although it receives less testing, it contains only the minimal changes necessary to effect the repair. Cisco has made available several rebuilds of mainline trains to address this vulnerability, but strongly recommends running only the latest maintenance release on mainline trains. * Interim Built at regular intervals between maintenance releases and receives less testing. Interims should be selected only if there is no other suitable release that addresses the vulnerability, and interim images should be upgraded to the next available maintenance release as soon as possible. Interim releases are not available through manufacturing, and usually they are not available for customer download from CCO without prior arrangement with the Cisco Technical Assistance Center (TAC). In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco TAC for assistance, as shown in the section following this table. +------------------------------------------------------------------------+ |Train |Description of |Availability of Fixed Releases | | |Image or Platform| | |------------------------+-----------------------------------------------+ | 11.x based releases | Rebuild |Interim| Maintenance | |------------------------+-------------+-------+-------------------------+ |11.1CA| |11.1(36)CA4**| | | |------+-----------------+-------------+-------+-------------------------+ |11.2 | |11.2(26e)** | | | |------+-----------------+-------------+-------+-------------------------+ |11.2P | |11.2(26)P5** | | | |------+-----------------+-----------------------------------------------+ |11.3 | |Not scheduled | |------+-----------------+-----------------------------------------------+ |11.3T | |Not scheduled | |------------------------+-----------------------------------------------+ |12.0 based releases |Rebuild |Interim|Maintenance | |------------------------+-------------+-------+-------------------------+ | |General | | | | |12.0 |Deployment | | |12.0(26) | | |release for all | | | | | |platforms | | | | |------+-----------------+-----------------------------------------------+ |12.0DA|xDSL support: |Migrate to 12.2DA; 12.2(10)DA2 - Aug-15-2003, | | |6100, 6200 |12.2(12)DA3 - Aug-22-2003: Engineering | | | |Specials available on request. | |------+-----------------+-----------------------------------------------+ |12.0DB|Early Deployment |Migrate to 12.3(1a) | | |6400 UAC for NSP | | |------+-----------------+-----------------------------------------------+ |12.0DC|Early Deployment |Migrate to 12.3(1a) | | |6400 UAC for NRP | | |------+-----------------+-----------------------------------------------+ | | |12.0(24)S2 | | | | | |12.0(23)S3 | | | | | |12.0(22)S5 | | | | | |12.0(21)S7 | | | | | |12.0(19)S4 | | | | |Core/ISP support:|12.0(18)S7 | | | |12.0S |GSR, RSP, c7200, |12.0(17)S7 | |12.0(25)S | | |c10k |12.0(16)S10 | | | | | |12.0(15)S7 | | | | | |12.0(14)S8 | | | | | |12.0(13)S8 | | | | | |12.0(12)S4 | | | | | |12.0(10)S8 | | | |------+-----------------+-----------------------------------------------+ |12.0SC|Cable/broadband |Migrate to 12.1(19)EC | | |ISP: ubr7200 | | |------+-----------------+-----------------------------------------------+ |12.0SL|100000 ESR:c10k |Migrate to 12.0(23)S3, **12.0(17)SL9 - | | | |Jul-15-2003 | |------+-----------------+-----------------------------------------------+ |12.0SP|Early Deployment |Migrate to 12.0(22)S5 | |------+-----------------+-----------------------------------------------+ | |Early Deployment |12.0(21)ST7 | | | |12.0ST|release for Core/|12.0(20)ST6 | | | | |ISP support: GSR,|12.0(19)ST6 | | | | |RSP, c7200 |12.0(17)ST8 | | | |------+-----------------+-----------------------------------------------+ |12.0SX|Early Deployment |Migrate to 12.0(22)S5 | |------+-----------------+-----------------------------------------------+ |12.0SY|Early Deployment |Migrate to 12.0(23)S3 | |------+-----------------+-----------------------------------------------+ |12.0SZ|Early Deployment |Migrate to 12.0(23)S3 | |------+-----------------+-----------------------------------------------+ |12.0T |Early Deployment |12.0(7)T3** | | | |------+-----------------+-------------+-------+-------------------------+ | |85xx ls1010 | | |12.0(26)W5(28) | | |-----------------+-------------+-------+-------------------------+ | |c5atm |12.0(24)W5 | | | | | |(26a) | | | | |-----------------+-------------+-------+-------------------------+ | |Cat4232 and |12.0(25)W5 | | | | |Cat2948G-L3 |(27) | | | |12.0W5|-----------------+-------------+-------+-------------------------+ | |C6MSM,C5rsfc, |Engineering | | | | |C5rsm, |Special | | | | | |available on | | | | | |request | | | | |-----------------+-------------+-------+-------------------------+ | |C3620, C3640, | | | | | |C4500, C7200, RSP| | | | |------+-----------------+-------------+-------+-------------------------+ |12.0WC|Early deployment |12.0(05)WC8 | | | | |2900XL-LRE,2900XL| | | | | |/3500XL; 2950 | | | | | |release | | | | |------+-----------------+-------------+-------+-------------------------+ |12.0WT|Early deployment |Engineering | | | | |Catalyst |Special | | | | |switches: |Available | | | | |cat4840g, |upon request | | | |------+-----------------+-----------------------------------------------+ |12.0X |Shortlived Early |All 12.0X(any letter) releases have migrated to| |(l) |Deployment |either 12.0T or 12.1 unless otherwise | | |Releases |documented in the X release technical notes | | | |pertaining to the specific release. Please | | | |check migration paths for all 12.0X releases. | |------------------------+-----------------------------------------------+ |12.1 based releases |Rebuild |Interim|Maintenance | |------------------------+-------------+-------+-------------------------+ | |General | | | | |12.1 |Deployment | |12.1 |12.1(19) | | |release for all | |(18.4) | | | |platforms | | | | |------+-----------------+-----------------------------------------------+ |12.1AA| |Migrate to 12.2 | |------+-----------------+-----------------------------------------------+ |12.1AX|Catalyst 3750 |12.1(14)EA1 -| | | | | |Engineering | | | | | |special | | | | | |available | | | | | |upon request | | | |------+-----------------+-------------+-------+-------------------------+ |12.1AY|Catalyst 2940 | | |12.1(13)AY | |------+-----------------+-----------------------------------------------+ |12.1DA|6160 platform |Migrate to 12.2DA | |------+-----------------+-----------------------------------------------+ |12.1DB|6400 UAC |Migrate to 12.3(1a) | |------+-----------------+-----------------------------------------------+ |12.1DC|6400 UAC |Migrate to 12.3(1a) | |------+-----------------+-----------------------------------------------+ |12.1E |Core Enterprise |12.1(8b)E14 | |12.1(19)E | | |support - c7200, |12.1(13)E7 | | | | |Catalyst 6000, |12.1(14)E4 | | | | |RSP |**12.1(12c)E7| | | | | |12.1(11b)E12-| | | | | |Aug-4-2003 | | | | | |12.1(6)E12 | | | |------+-----------------+-----------------------------------------------+ |12.1EA|12.1(4)EA |Migrate to 12.1(13)EA1c | | |12.1(6)EA | | | |12.1(8)EA | | | |12.1(9)EA | | | |12.1(11)EA | | | |-----------------+-----------------------------------------------+ | |12.1(12c)EA |12.1(13)EA1c | | | | |12.1(13)EA | | | | |------+-----------------+-------------+-------+-------------------------+ |12.1EB|LS1010 | | |12.1(14)EB | |------+-----------------+-------------+-------+-------------------------+ |12.1EC|Early Deployment | | |12.1(19)EC (scheduled | | | | | |last week of July) | |------+-----------------+-------------+-------+-------------------------+ |12.1EV|Early Deployment | | |12.1(12c)EV | |------+-----------------+-------------+-------+-------------------------+ |12.1EW|Early Deployment | | |12.1(13)EW,12.1(19)EW | | |Cat4000 L3 | | | | |------+-----------------+-------------+-------+-------------------------+ |12.1EX|Early deployment |12.1(13)EX2 | | | |------+-----------------+-------------+-------+-------------------------+ |12.1EY| | |12.1(14)E4 | | | |------+--+--------------+-------------+-------+-------------------------+ |12.1YJ| | |12.1(14)EA1 -| | | | | | |Jul-28-2003 | | | |------+-----------------+-------------+-------+-------------------------+ |12.1T |Early deployment |12.1(5)T15** | | | |------+-----------------------------------------------------------------+ |12.1X |12.1X releases generally migrate to 12.1T, 12.2 or 12.2T as | |(l) |specified below. Please refer to specific train Technical notes | | |for documented migration path. | |------+-----------------------------------------------------------------+ |12.1XA|Short lived Early|Migrate to 12.1(5)T15 | | |Deployment | | | |Release | | |------+-----------------+-----------------------------------------------+ |12.1XC|Short lived Early|Migrate to12.2(17) | |12.1XD|Deployment | | |12.1XH|Releases | | |12.1XI| | | |------+-----------------+-----------------------------------------------+ |12.1XB|Short lived Early|Migrate to 12.2(15)T5 | |12.1XF|Deployment | | |12.1XG|Releases | | |12.1XJ| | | |12.1XL| | | |12.1XP| | | |12.1XR| | | |12.1XT| | | |12.1YB| | | |12.1YC| | | |12.1YD| | | |12.1YH| | | |------+-----------------+-----------------------------------------------+ |12.1XM|Short lived Early|Migrate to 12.2(2)XB11 | |12.1XQ|Deployment | | |12.1XV|Releases | | |------+-----------------+-----------------------------------------------+ |12.1XU|Short lived Early|Migrate to 12.2(4)T6 | | |Deployment | | | |Release | | |------+-----------------+-----------------------------------------------+ |12.1YE|Short lived Early|Migrate to 12.2(2)YC | |12.1YF|Deployment | | |12.1YI|Release | | |------------------------+-----------------------------------------------+ |12.2 based releases |Rebuild |Interim|Maintenance | |------------------------+-------------+-------+-------------------------+ | |General |12.2(16a) | | | |12.2 |Deployment (GD) |12.2(12e) | |12.2(17) | | |candidate for all|12.2(10d) | | | | |platforms | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2B |12.2(2)B-12.2(4) |12.3(1a) | | | | |B7 | | | | | |-----------------+-------------+-------+-------------------------+ | |12.2(4)B8-12.2 |12.2(16)B1 | | | | |(16)B | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2BC|Early Deployment |12.2(15)BC1 | | | | |Release |(Scheduled | | | | | |end of July) | | | |------+-----------------+-------------+-------+-------------------------+ |12.2BW|Early Deployment |Migrate to | | | | |for use with |12.3(1a) | | | | |7200, 7400, and | | | | | |7411 platforms | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2BX|Broadband/Leased | | |12.2(16)BX | | |line | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2BZ|Early Deployment |12.2(15)BZ1 | | | | |Release | | | | |------+-----------------+-----------------------------------------------+ |12.2CX|Early Deployment |Migrate to 12.1(15)BC1 | | |Release | | |------+-----------------+-----------------------------------------------+ |12.2CY|Early Deployment |Migrate to 12.1(15)BC1 | | |Release | | |------+-----------------+-----------------------------------------------+ |12.2DA|Early Deployment |12.2(10)DA2 -| | | | |Release |Jul-15-2003 | | | | | |12.2(12)DA3 -| | | | | |Aug-22-2003 | | | | | |Enginering | | | | | |Special | | | | | |available on | | | | | |request | | | |------+-----------------+-----------------------------------------------+ |12.2DD|Early Deployment |Migrate to 12.3(1a) | | |Release | | |------+-----------------+-----------------------------------------------+ |12.2DX|Early Deployment |Migrate to 12.3(1a) | | |Release | | |------+-----------------+-----------------------------------------------+ |12.2JA|Cisco Aironet | | |12.2(11)JA | | |hardware | | | | | |platforms: | | | | | |Introduction of | | | | | |Access Point | | | | | |feature in IOS, | | | | | |Cisco 1100 Series| | | | | |Access Point | | | | | |(802.11b) | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2MB|Specific |12.2(4)MB12 | | | | |Technology ED for| | | | | |2600 7500 (GPRS/ | | | | | |PDSN/GGSN | | | | | |2600/7200/7500) | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2MC|Early Deployment:|12.2(13)MC1 | | | | |IP RAN |CCO: 7/24/03 | | | |------+-----------------+-------------+-------+-------------------------+ |12.2MX| |12.2(8)YD | | | | | | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2S |Core/ISP support:|12.2(14)S1 |12.2 | | | |GSR, RSP, c7200 | |(16.5)S| | |------+-----------------+-------------+-------+-------------------------+ |12.2SX|IOS Support for |12.2(14)SX1 | | | | |C6500 Supervisor | | | | | |3 | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2SY|VPN feature |12.2(14)SY1, | | | | |release for c6k/ |12.2(8)YD | | | | |76xx VPN service | | | | | |module. | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2SZ|7304 Platform |12.2(14)SZ2 | | | |------+-----------------+-------------+-------+-------------------------+ | | |12.2(15)T4/ | |No more maintenance | | |New Technology |5,12.2(13)T5,| |trains for 12.2T are | |12.2T |Early Deployment |12.2(11) |12.2 |planned, please migrate | | |(ED) release for |T9,12.2(8) |(16.5)T|to latest 12.3 Mainline | | |all platforms |T10, | |release. | | | |12.2(4)T6 | | | |------+-----------------+-----------------------------------------------+ |12.2X |Short lived Early|Many short lived releases migrate to the same | |(l) |Deployment |train; the trains below this point until the | |12.2Y |Releases - |following section are not grouped by strict | |(l) | |alphabetical order, but are grouped by | | | |migration path. Please review documented | | | |migration paths for your trains. | |------+-----------------+-----------------------------------------------+ |12.2XA|Short lived Early|Migrate to 12.2(11)T9 | | |Deployment | | | |Releases | | |------+-----------------+-----------------------------------------------+ |12.2XS| |12.2(2)XB11 | |------+-----------------+-----------------------------------------------+ |12.2XD|Short lived Early|Migrate to 12.2(15)T5 | |12.2XE|Deployment | | |12.2XH|Releases | | |12.2XI| | | |12.2XJ| | | |12.2XK| | | |12.2XL| | | |12.2XM| | | |12.2XQ| | | |12.2XU| | | |12.2XW| | | |12.2YA| | | |12.2YB| | | |12.2YC| | | |12.2YF| | | |12.2YG| | | |12.2YH| | | |12.2YJ| | | |12.2YT| | | |------+-----------------+-----------------------------------------------+ | |Short lived Early| | |12.2YN|Deployment |Migrate to 12.2(13)ZH | | |Releases | | |------+-----------------+-----------------------------------------------+ | |Short lived Early|Migrate to 12.2(14)SY1 available Aug-4-2003: | |12.2YO|Deployment |Engineering Special available on request | | |Releases | | |------+-----------------+-----------------------------------------------+ | |Early Deployment | | | | |12.2XB|Release with |12.2(2)XB11 | | | | |continuing | | | | | |support | | | | |------+-----------------+-----------------------------------------------+ |12.2XC|Short lived Early|Migrate to 12.2(16)B1 | | |Deployment | | | |Releases | | |------+-----------------+-----------------------------------------------+ |12.2XF|Short lived Early|Migrate to 12.2(15)BC1 | | |Deployment | | | |Release UBR10000 | | |------+-----------------+-----------------------------------------------+ |12.2XG|Short lived Early|Migrate to 12.2(8)T10 | | |Deployment | | | |Release | | |------+-----------------+-----------------------------------------------+ |12.2XN|Short lived Early|Migrate to 12.2(11)T9 | |12.2XT|Deployment | | | |Releases | | |------+-----------------+-----------------------------------------------+ |12.2YD|Short lived Early|Migrate to 12.2(8)YY | | |Deployment | | | |Release | | |------+-----------------+-----------------------------------------------+ | |Short lived Early| | | | |12.2YP|Deployment |**12.2(11)YP1| | | | |Release | | | | |------+-----------------+-----------------------------------------------+ |12.2YK| |Migrate to 12.2(13)ZC | |------+-----------------+-----------------------------------------------+ |12.2YL|Short lived Early|Migrate to 12.2(13)ZH | |12.2YM|Deployment | | |12.2YU|Releases | | |12.2YV| | | |------+-----------------+-----------------------------------------------+ |12.2YQ|Short lived Early|Migrate to 12.2(15)ZL | |12.2YR|Deployment | | | |Releases | | |------+-----------------+-----------------------------------------------+ |12.2YS|Short lived Early|12.2(15)YS/ | | | | |Deployment |1.2(1) | | | | |Release | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2YW|Short lived Early|12.2(8)YW2 | | | | |Deployment | | | | | |Releases | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2YX|Short lived Early|12.2(11)YX1 | | | | |Deployment | | | | | |Release | | | | | |Crypto for 7100/ | | | | | |7200 | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2YY|Short lived Early|12.2(8)YY3 | | | | |Deployment | | | | | |Releases | | | | | |IOS support for | | | | | |General Packet | | | | | |Radio Service | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2YZ|Short lived Early|12.2(11)YZ2 | | | | |Deployment | | | | | |Release | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2ZA|Short lived Early| | |12.2(14)ZA2 | | |Deployment | | | | | |Release | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2ZB|Short lived Early|12.2(8)ZB7 | | | | |Deployment | | | | | |Release | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2ZC|Short lived Early| | |12.2(13)ZC | | |Deployment | | | | | |Release | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2ZD|Short lived Early|Not Scheduled| | | | |Deployment | | | | | |Release | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2ZE|Short lived Early|12.3(1a) | | | | |Deployment | | | | | |Release | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2ZF|Short lived Early|Not | | | | |Deployment |Vulnerable | | | | |Release | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2ZG|Short lived Early|Not | | | | |Deployment |Vulnerable | | | | |Release | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2ZH|Short lived Early|Not | | | | |Deployment |Vulnerable | | | | |Release | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2ZJ|Short lived Early|12.2(15)ZJ1 | | | | |Deployment | | | | | |Release | | | | |------+-----------------+-------------+-------+-------------------------+ |12.2ZL|Short lived Early|Not | | | | |Deployment |Vulnerable | | | | |Release | | | | |------------------------+-----------------------------------------------+ |12.3 based releases |NOT VULNERABLE | |------------------------------------------------------------------------+ |Notes: **Marked versions of code are not available on CCO. Please | |contact TAC and request the specific images you need posted. | +------------------------------------------------------------------------+ Notes: ** Marked versions of code are not available on CCO. Please contact the Cisco TAC and request the specific images you need posted. Obtaining Fixed Software ======================== Customers with contracts should obtain upgraded software free of charge through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on the Cisco worldwide website at http://www.cisco.com/tacpage/sw-center/sw-ios.html. Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with obtaining the free software upgrade(s). Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Please have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Please do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades. See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers, instructions, and e-mail addresses for use in various languages. Workarounds =========== AFTER APPLYING THE WORKAROUND the input queue depth may be raised with the hold-queue <new value> in interface command -- the default size is 75. This will allow traffic flow on the interface until the device can be reloaded. Cisco recommends that all IOS devices which process IPv4 packets be configured to block traffic directed to the router from any unauthorized source with the use of Access Control Lists (ACLs). This can be done at multiple locations, and it is recommended that you review all methods and use the combination which fits your network best. Legitimate traffic is defined as management protocols such as telnet, snmp or ssh, and configured routing protocols from explicitly allowed peers. All other traffic destined to the device should be blocked at the input interface. Traffic entering the network should also be carefully evaluated and filtered at the network edge if destined to an infrastructure device. Although network service providers must often allow unknown traffic to transit their network, it is not necessary to allow that same traffic destined to their network infrastructure. Several white papers have been written to assist in deploying these recommended security best practices. ACLs can have performance impact on certain platforms, so care should be taken when applying the recommended workarounds. Receive ACLs For distributed platforms, receive path access lists may be an option starting in Cisco IOS software versions 12.0(21)S2 for the c12000 and 12.0 (24)S for the c7500. The receive access lists protect the device from harmful traffic before the traffic can impact the route processor. The CPU load is distributed to the line card processors and helps mitigate load on the main route processor. The white paper entitled "GSR: Receive Access Control Lists" will help you identify and allow legitimate traffic to your device and deny all unwanted packets: http://www.cisco.com/warp/customer/707/racl.html Infrastructure ACLs Although it is often difficult to block traffic transiting your network, it is possible to identify traffic which should never be allowed to target your infrastructure devices and block that traffic at the border of your network. The white paper entitled "GSR: Receive Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection ACLs: http://www.cisco.com/warp/customer/707/iacl.html Transit ACLs The two techniques described above protect infrastructure devices. This IP protocol ACL can also be used to filter transit traffic passing through a network. The ACL will need to permit all protocols used by end users, not just those destined to routers. Since end users can run a wide array of protocols, often unexpected or uncommon protocols, these protocol requirements must be well understood prior to deploying this ACL. The provided list is not a complete list of permissible protocols. This access-list is applied inbound on edge facing interfaces. For complete protection this access-list needs to be implemented on the edge router. For basic TCP,UDP and ICMP, the following ACL will provide protection: access-list 101 permit tcp any any access-list 101 permit udp any any !! GRE tunnel if required access-list 101 permit gre any any !! IPSec ESP if required access-list 101 permit esp any any !! IPSec AH if required access-list 101 permit ah any any access-list 101 permit icmp any any access-list 101 deny ip any any The last statement of the Transit ACL should be a deny any any for IP traffic. Prior to deploying ACLs that filter transit traffic, a classification ACL can be used to help identify required permit statements. A classification ACL is an ACL that permits a series of protocols. Displaying access-list entry hit counters helps determine required protocols: entries with zero packets counted are likely not required. Classification access-lists are detailed in the above link for infrastructure access-lists. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory. If PSIRT becomes aware of any sign of public announcement of the crafted packet, or there is any sign of exploitation of this vulnerability, a follow-up announcement will be sent to our standard distribution list immediately with further details to assist network administrators in mitigation. Status of This Notice: INTERIM ====================== This is an INTERIM notice. Although Cisco cannot guarantee the accuracy of all statements in this notice, all of the facts have been checked to the best of our ability. Cisco does not anticipate issuing updated versions of this advisory unless there is some material change in the facts. Should there be a significant change in the facts, Cisco will update this advisory. Distribution ============ This notice will be posted on the Cisco worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml at 21:00 GMT on July 17th, 2003. In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and will be posted to the following e-mail and Usenet news recipients at the public release date and time: * cust-security-announce(a)cisco.com * bugtraq(a)securityfocus.com * full-disclosure(a)lists.netsys.com * first-teams(a)first.org (includes CERT/CC) * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * nanog(a)merit.edu * sanog(a)sanog.org * comp.dcom.sys.cisco * Various internal Cisco mailing lists Future updates of this advisory, if any, will be placed on the Cisco worldwide web server. Users concerned about this problem are encouraged to check the URL given above for any updates. Revision History ================ +-------------------------------------------+ | Revision | 17-July-2003 | Initial public | | 1.0 | 0:00 GMT | release | +-------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on the Cisco worldwide website at http://www.cisco.com/warp/public/707/sec_incident_response.shtml. This includes instructions for press inquiries regarding Cisco security notices. All Cisco Security Advisories are available at http://www.cisco.com/go/psirt. - -------------------------------------------------------------------------- This notice is Copyright 2003 by Cisco Systems, Inc. This notice may be redistributed freely after the release date given at the top of the text, provided that redistributed copies are complete and unmodified, and include all date and version information. - -------------------------------------------------------------------------- All contents are Copyright © 1992-2003 Cisco Systems, Inc. All rights reserved. Important Notices and Privacy Statement. -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.2 iQA/AwUBPxYP5XsxqM8ytrWQEQJOfwCg04JnuUYEIYQZyfHAeClX5p2SpngAoNMn t2zHq5JVCmsChl0DrSN9jMFq =6bis -----END PGP SIGNATURE-----

1 0

NetForum 2003
by Geoff Cant 16 Jul '03

16 Jul '03

Hi there, I'd like to thank the organisers and all the nznog people who attended NetForum2003 for being really interesting and friendly - I had a great time. Despite being one of the few students there (I was from Massey PN) everyone was amiable and great to talk to. I'd especially like to thank Joe Abbley for his immensely interesting and funny BGP presentations, and Barry Greene and Evi Nemeth for their informative (and scary - 98% rubbish at root-servers) sessions. Thanks very much guys, much looking forward to NetForum 2004 -- Geoff Cant <geoffrey.cant.1(a)uni.massey.ac.nz> (I hope the above didn't sound too gushy, but I really did have a great time :)

5 4

Apologies for 'Test' email
by Tim John 16 Jul '03

16 Jul '03

Hi people, I sent a test message to a customers account yesterday (which had nothing to do with NZNOG), but unfortunately it ended up here. Not sure what the problem was, but putting it down to chubby fingers .... For those who didn't ignore it, please do :) Tim DISCLAIMER: The content of this email is confidential and may contain legally privileged information intended only for the individual or entity named above. Access to this message by anyone else is unauthorised. If you are not the intended recipient, please be advised that the use, distribution and publication of the above information is prohibited. If you have received this email in error, please contact Domainz by returning the email and destroying the original. Thank you.

1 0

RE: [nznog] IPv6
by Chris Hellberg 15 Jul '03

15 Jul '03

when I was running the v6ix in Wellington I was running EBGP sessions with most people who had connections; seemed to work well when I had a bunch of open-souce software mirrors which were v6-accessible and people had routes that went straight to the IX. There was also tunnel to the 6bone at Merit, for those who wanted to have a nosey at the 6bone routing table, although there were some 2000::/24 prefixes on the 6bone. I've talked to Si at Citylink about getting a PI peering block for WIX and APE, but it wasn't a huge priority. I used addresses from a freenet allocation and carved up a /64 in to a bunch of /126s and used them as point-to-point links. Not the best solution in the world, but worked for the purpose. -----Original Message----- From: perry(a)deeper.co.nz [mailto:perry(a)deeper.co.nz] Sent: Wednesday, 16 July 2003 21:43 To: Joe Abley Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] IPv6 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > You can't plumb tunnels right now, today? Or is the problem that > there's just no local place to plumb a tunnel to? > > (see http://ipv6tb.he.net/ for a tunnel broker run by clueful people in > the US). ahh, but tunnels to the US mean that you have the irritating problem that pinging someone on the same ISP as you can give you up to 3,000ms of latency as it transits from here to the US and back again. You have issues when they are overloaded, or down. You have issues if the internet between here and there decides that packets should be routed via darkest peru. IPv6 was designed to work in the situation where you have to bridge large IPv4 clouds. A much better solution for people in New Zealand is to use 6to4 addressing, especially if you're on the end of ADSL or similar and don't have native transport. 6to4 addressing means that whatever device(s) have non-RFC1918 IPv4 addresses can have a /48 assigned to them. 2003:<high two octets of IPv4 address>:<low two octets of IPv4 address>::/48. To route to another 2002::/16 address over IPv4 you just take the packet, encapsulate it in IPv4, and send it to the embedded IPv4 address. Linux and FreeBSD both support this. Latency to other 6to4 addresses is about the same as IPv4, avoiding the entire US round trip. To talk from a 6to4 address to a non-6to4 IPv6 address you route via ::192.88.99.1 which is an AnyCast address. Unfortunately, last time I looked the nearest 192.88.99.1 AnyCast announcement appeared to be in Germany. Is there any chance of someone putting forward 6to4 anycast gateway in the APE and/or the WIX? Of course the problem here is that probably 50% of it's traffic will be international. In an unrelated note, the MetaNet has been used by several people in NZ who are interested in playing around with more interesting networks without breaking things that people pay to use. We use it for peering IPv6 without having to go via the US and we'd be interested in organising IPv6 tunnels with like minded people (either using wand, gre, or 6in4 tunnels) Unfortunately the MetaNet wouldn't handle multicast very well (or we'd be having a good tinker with it) Resources: * http://www.wlug.org.nz/DancingPenguin (A IPv6 enabled website in New Zealand which is useful for testing with) * http://www.wlug.org.nz/IPv6LessonsLearnt (For some random things we've discovered about IPv6 the hard way, so you don't have to) * http://www.wlug.org.nz/6to4 (Information about 6to4 under Linux) * http://www.wlug.org.nz/IPv6 (Information about IPv6 on the wiki) * http://www.nevada.net.nz/~pmurray/6to4.html (6to4 under FreeBSD) If you want to chat about it, we're usually hanging around in #wlug on Undernet. irc://undernet/%23wlug - -- <f00Dave> Look, rejects, this is #OpenGL, not #GEEKSEX. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) Comment: Only when you are sure they have you, can you stop being paranoid iD8DBQE/FQ0TcAgRpy8z8UQRAhadAJ4gAGn+YRABqt6A7X58K73hBQPNugCgy3ie 05qO9xRxAXyaG1K5EElVfAY= =+lkH -----END PGP SIGNATURE----- _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------

1 0

dns and routing slides
by Joe Abley 15 Jul '03

15 Jul '03

The DNS slides I used to talk about DNS, TSIG, DNSSEC and reverse DNS can be found here: http://www.isc.org/misc/nznog/01-Introduction.ppt http://www.isc.org/misc/nznog/06-Reverse.ppt http://www.isc.org/misc/nznog/07-dnssec.ppt The cisco slides I occasionally referred to whilst waving my hands about BGP can be found here: ftp://ftp-eng.cisco.com/pfs/isp-workshops/studentcd-2003a/ Workshop_Materials The whiteboard scribblings and frequent rambling tangents were fortunately not recorded for posterity, but an air ticket and a nominal amount of beer can easily secure a repeat performance :) Joe

1 0

Test
by Tim John 15 Jul '03

15 Jul '03

This is a test. Please ignore .... Tim DISCLAIMER: The content of this email is confidential and may contain legally privileged information intended only for the individual or entity named above. Access to this message by anyone else is unauthorised. If you are not the intended recipient, please be advised that the use, distribution and publication of the above information is prohibited. If you have received this email in error, please contact Domainz by returning the email and destroying the original. Thank you.

1 0