full-disclosure - Re: Should nmap cause a DoS on cisco routers?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 02 Jul 2010 16:05:37 -0300
From: Mailing lists at Core Security Technologies <lists@...esecurity.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Should nmap cause a DoS on cisco routers?

Hello Mr. Dobbins.

Normally, I'd not reply to this post but something about it prompted me
to do it.

Dobbins, Roland wrote:
> On Jul 2, 2010, at 7:01 AM, Dan Kaminsky wrote:
> 
>> Permanent DoS's are unacceptable even from intentionally malicious
>> traffic, let alone a few nmap flags. They're unacceptable to us,
>> they're unacceptable to Microsoft (see: MSRC bug bar), and even
>> Cisco PSIRT has shown up on thread desiring to clean things up.
> 
> Again, causing the RP CPU to go to 100% due to punted
> management-plane traffic isn't a new phenomenon - it's
> well-understood amongst network operators, as are BCPs which mitigate
> the risk of such an occurrence.

This is an obvious fallacy. Here's why:

You've unilaterally decided that your interpretation of the original
message from Shang Tsung is the correct one. Namely that what caused the
devices to *crash and reboot* was the amount of traffic they were
receiving on the SNMP ports. His email did not state such thing.

Then on the basis of taking your own assumption as truth and not based
on factual data you then proceed to dismiss the problem as nothing new
or worthy of discussion but simply a matter of improper configuration or
network architecture.

You may or may not be wrong but at this point in the thread and without
actual evidence (packet dumps, repro steps, something@!#) it's simply
anybody's guess what actually happened to Mr. Shang's networking devices
of unknown brands and models, running unknown firmware.

You and others then proceeded to implicitly assume that Mr. Shang's
devices are in fact Cisco gear by speculating about what PSIRT should or
should not do (Juniper's team is called SIRT, 3Com's is SRT and HUawei's
is NSIRT...)

Now, further down the email thread somebody from Cisco's PSIRT actually
chimed in (hola Dario!) asking for technical details.

Perhaps we should too ask and wait for actual data from Mr. Shang and
defer for later the construction of hypothetical explanations that are
as robust as a brazilian soccer team with a 1 goal lead.

-ivan

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/