bugtraq - Re: Addressing Cisco Security Issues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <006201c41606$46285640$231a90d8@NTAUTHORITY>
Date: Mon, 29 Mar 2004 22:21:15 -0500
From: "Geoincidents" <geoincidents@...info.org>
To: "Clayton Kossmeyer" <ckossmey@...co.com>,
   "Geo." <geoincident1@...info.org>
Cc: <full-disclosure@...ts.netsys.com>, <bugtraq@...urityfocus.com>
Subject: Re: Addressing Cisco Security Issues

----- Original Message ----- 
From: "Clayton Kossmeyer" <ckossmey@...co.com>

> downloads.  The reasons for this are many, but one of the major ones
> is that SPs/ISPs want to control what versions of software are
> deployed within their networks.

I can certainly understand an ISP's desire to control this, however I AM THE
ISP. I've got Alltel the DSL provider on one side and Cisco the hardware
provider on the other side and all I wanted to do was get a secure version
of CBOS and both Alltel and Cisco were giving me the runaround with neither
of them accepting responsibility for maintaining the security of the device.
So here I am the ISP trying to make sure I can secure the devices on my
network after receiving a warning from Cisco and Cisco won't give me the
patch. Well that makes a lot of sense.

> Having said that, there is an exception and escalation process for
> situations like yours.

Yes I know, but you should also know I can't dedicate a day or two of my
life to downloading a stupid security patch. It should not be this difficult
to get security patches from Cisco. Cisco provides the majority of equipment
that makes the internet function, that dominance comes with a responsibility
to make sure people can get patches when an exploit is discovered. I don't
care about a new version, patch the old one like MS does for all I care.
Just put the darn patches where everyone can get at them without having to
beg and escalate.

> If you feel as though your case is not being addressed urgently
> enough, you can call the TAC at any time, referencing your case
> number, to have the priority raised or the case escalated further.

That's fine for support issues but we are talking about security patches,
these should not require we open any sort of ticket or have a contract or
anything of the sort. Patches should be available to everyone free of charge
and readily available for download.

> I'll follow up with you unicast and we can figure out which image
> you'll need.

I appreciate it, but I've already downloaded the update from a non cisco
source and applied it. I didn't need anyone at cisco to spend any time on
me, all I needed was the patched image file.

I don't know who calls the shots at cisco but they really should realize
that when it's important enough to release a security bulletin, end users,
dsl providers, isp's, none of them have a choice anymore, it's either update
or die so what's the point of restricting access to the patched versions?

Geo.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html