Antonio Soares wrote:
Hello group,
What actions are you taking ? What is the real risk ?
http://www.cisco.com/warp/public/707/cisco-sa-20090908-tcp24.shtml
If I'm reading the notes correctly, to exploit the problem the attacker
must be able to complete a TCP 3-way handshake. That would imply that
the attackers packets can either get through iACLs or that there are no
ACLs in place. This will mainly affect those people with unsecured
TCP-based services such as telnet, SSH, RSH, SCP, HTTP, and HTTPS.
Routers providing WebVPN services are at risk and need to be upgraded to
fix the problem since disabling WebVPN is probably not an option. Other
TCP services like BGP and LDP shouldn't be affected unless one of your
configured neighbors is going to exploit the vulnerability. If you
can't trust your own equipment or your peers to not exploit
vulnerabilities on your equipment....
So the hundreds of thousands of "under-managed" IOS devices out there
that have the default config with TCP services like HTTP and telnet
enabled are going to suffer. All the more reason for Cisco to change
the default configuration to default to having all services disabled out
of the box. Make the admin turn on features themselves that compromise
their security. No reason to compromise their security for them.
Fixing this would require implementing security basics such as creating
a VTY ACL, creating a HTTP/HTTPS ACL or disabling it altogether if it's
not used, implementing CoPP, iACLs, etc. Usual stuff.
It looks like I'll be doing a round of upgrades in November. It's time
anyway.
Justin
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
