full-disclosure - Cisco PIX embryonic state machine TTL(n-1) DoSand Cisco PIX embryonic state machine 1b data DoS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue Mar  7 20:17:34 2006
From: pigrelax at yandex.ru (alex)
Subject: Cisco PIX embryonic state machine TTL(n-1)
	DoSand Cisco PIX embryonic state machine 1b data DoS

Both cases are bad example. First case demonstrates Cisco routers internal
architecture, not vulnerability. In second case vulnerability was in CGI Web
application Cisco uses on corporate site, not in Cisco product. It was
promptly patched immediately after vendor contact.

-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Georgi
Guninski
Sent: Tuesday, March 07, 2006 10:49 PM
To: Randy Ivener (rivener)
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] Cisco PIX embryonic state machine TTL(n-1)
DoSand Cisco PIX embryonic state machine 1b data DoS

On Tue, Mar 07, 2006 at 11:05:04AM -0800, Randy Ivener (rivener) wrote:
> 
> We greatly appreciate the opportunity to work with researchers on
> security vulnerabilities, and welcome the opportunity to review and
> assist in product reports.
> 
>

indeed, you really appreciate it:

http://www.schneier.com/blog/archives/2005/07/cisco_harasses.html
Cisco threatened legal action to stop the conference's organizers from
allowing a 24-year-old researcher for a rival tech firm to discuss how he
says hackers could seize control of Cisco's Internet routers, which dominate
the market.

http://www.eweek.com/article2/0,1895,1843451,00.asp
Cisco has initiated system-wide resets of user passwords and patched the
search tool flaw, he added.

-- 
where do you want bill gates to go today?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/