full-disclosure - Re: Should nmap cause a DoS on cisco routers?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <A8122BBE-9AF1-48E0-B2AF-5DDF1C681DE5@arbor.net>
Date: Thu, 1 Jul 2010 11:07:36 +0000
From: "Dobbins, Roland" <rdobbins@...or.net>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Should nmap cause a DoS on cisco routers?

On Jul 1, 2010, at 5:23 PM, Thierry Zoller wrote:

> If a device crashes when being scanned - it's a vulnerability.

It sounds to me as if what happened was that he ended up driving the CPUs of the devices in question to 100%, and they stopped handling control-plane traffic and fell over.  There are infrastructure self-protection best current practices (BCPs) which can be deployed to defend against infrastructure-targeted DoS.

I've only seen this happen a few hundred times or so, so I could be wrong, of course.

;>

As the original poster posited:

> Is this a configuration error of the networking devices?

The answer is, almost assuredly, "Yes."

-----------------------------------------------------------------------
Roland Dobbins <rdobbins@...or.net> // <http://www.arbornetworks.com>

    Injustice is relatively easy to bear; what stings is justice.

                        -- H.L. Mencken

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/