Hi Cisco PSIRT (and c-nsp), this one is specifically making me unhappy:
On Wed, Sep 23, 2009 at 12:15:00PM -0400, Cisco Systems Product Security
Incident Response Team wrote:
> Cisco Security Advisory: Cisco IOS Software Tunnels Vulnerability
[..]
> +-------------------------------------------------------------------+
> | Major | Availability of Repaired Releases |
> | Release | |
> |------------+------------------------------------------------------|
> | 12.0 | Vulnerable; first fixed in 12.4 | |
> |------------+--------------------------------------+---------------|
> | 12.1 | Vulnerable; first fixed in 12.4 | |
> |------------+--------------------------------------+---------------|
> | 12.2 | Vulnerable; first fixed in 12.4 | |
> |------------+--------------------------------------+---------------|
> | 12.3 | Vulnerable; first fixed in 12.4 | |
> |------------+--------------------------------------+---------------|
What exactly does this mean?
- there will never be a fixed 12.0, 12.1, 12.2 or 12.3 IOS, and we
have to upgrade all routers to 12.4 IOS, which is very likely to
require DRAM and Flash upgrades, and in many cases will mean "end of
the affected device, forklift upgrade" (because there might not even
*be* a 12.4 IOS)?
[Yes, we could turn off all tunneling, but the tunnels are part of
our 'wash-this-traffic' IDS/IDP solution, and I don't want to lose
that functionality]
- 12.0-fixed, 12.1-fixed, 12.2-fixed, 12.3-fixed will be shipped later?
If someone is listening: please provide at least fixed 12.2 and 12.3
IOS versions, as this is quite likely going to be a LARGE installed
base of now-very-unhappy customers. 12.0 and 12.1 would be nice as well,
of course.
Also, another question remains: the "malformed GRE packet" - does it
have to contain proper tunnel src + tunnel dst IP addresses (in which
cases this is easy to mitigate at our borders and with customer-facing
uRPF), or is it sufficient if the GRE packet has a destination address
that is configured "anywhere on the box", and the source address doesn't
matter? This is not fully clear from the mitigation companion document.
gert
--
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]
fax: +49-89-35655025 [email protected]
pgprJSsJHjiDG.pgp
Description: PGP signature
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
