full-disclosure - Re: Should nmap cause a DoS on cisco routers?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 2 Jul 2010 23:24:42 +0000
From: "Dobbins, Roland" <rdobbins@...or.net>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Should nmap cause a DoS on cisco routers?

On Jul 3, 2010, at 2:05 AM, Mailing lists at Core Security Technologies wrote:

> Perhaps we should too ask and wait for actual data from Mr. Shang 

I acknowledged this deeper in the thread - and also noted that since I've seen the same kind of reported behavior not above two or three hundred times in the past, that it sure looks like a classic RP DoS due to punted management-plane traffic.

I used to work for Cisco, and have the highest respect for the PSIRT team; I'm sure if there's an issue beyond simple BCPs, they'll resolve it.

In the meantime, everyone should ensure that their networks disallow control- and management-plane traffic from unauthorized nodes via iACLs, CoPP, et. al.; and also investigate rate-limiting management- and control-plane traffic in a situationally-appropriate manner via CoPP, HWRL, et. al.
-----------------------------------------------------------------------
Roland Dobbins <rdobbins@...or.net> // <http://www.arbornetworks.com>

    Injustice is relatively easy to bear; what stings is justice.

                        -- H.L. Mencken

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/