RE: Cisco Workaround

["Martin, Olivier" <olivier.martin () ccq org>]

My .02 cents..

There are ways around that, such as denying packets to terminate on routers
interface from unknown addresses as there is no need for these protocols on
cisco routers exept protocol 103 used for PIM.  As multicast routing is not
used on the commercial internet, it can safely be removed.

Olivier


-----Message d'origine-----
De : Tim Donahue [mailto:TDonahue () haynesconstruction com]
Envoyé : Friday, July 25, 2003 3:43 PM
À : 'Ghaith Nasrawi'
Cc : firewalls () securityfocus com; security-basics () securityfocus com
Objet : RE: Cisco Workaround


Hmmm.... Why don't you open up the protocols from the addresses that you
need.  Isn't this a standard firewalling technique?

Plus I believe that they said that there are new versions of IOS that are
not vulnerable to this attack, which means that you can upgrade IOS and
resolve the issute all together.

Tim Donahue



> -----Original Message-----
> From: Ghaith Nasrawi [mailto:libero () aucegypt edu] 
> Sent: Friday, July 25, 2003 11:33 AM
> Cc: firewalls () securityfocus com; security-basics () securityfocus com
> Subject: RE: Cisco Workaround
>
>
> Well, my question is; what the hell if I was using any of 
> these protocols?? Didn't cisco think of that?? They should 
> have suggested a more decent solution.
>
>
> ./Ghaith
> ===============
>
> Today is the tomorrow you worried about yesterday
>
>
>
>
>
> -----Original Message-----
> From: jamesworld () intelligencia com 
> [mailto:jamesworld () intelligencia com]
>
> Sent: Wednesday, July 23, 2003 6:48 PM
> To: Alvaro Gordon-Escobar
> Cc: firewalls () securityfocus com; security-basics () securityfocus com
> Subject: Re: Cisco Workaround
>
> Alvaro,
>
> No.  The protocol blocked by the access-list is protocol 53 
> not protocol
>
> TCP or protocol UDP port 53.
>
> If you need further info, let me know,
>
> -James
>
>
>
> At 09:15 7/23/2003, Alvaro Gordon-Escobar wrote:
> > will this access list modification prevent my internal DNS 
> server from
> > updates to it self from my telco's DNS server?
> >
> > access-list 101 deny 53 any any
> > access-list 101 deny 55 any any
> > access-list 101 deny 77 any any
> > access-list 101 deny 103 any any
> > !--- insert any other previously applied ACL entries here
> > !--- you must permit other protocols through to allow normal
> > !--- traffic -- previously defined permit lists will work
> > !--- or you may use the permit ip any any shown here access-list 101 
> > permit ip any any
> >
> > Thanks in advance
> >
> > ~alvaro Escobar
> >
> > -------------------------------------------------------------
> ----------
> ----
> > -------------------------------------------------------------
> ----------
> -----
>
>
> --------------------------------------------------------------
> ----------
> ---
> --------------------------------------------------------------
> ----------
> ----
>
>
> --------------------------------------------------------------
> -------------
> --------------------------------------------------------------
> --------------

---------------------------------------------------------------------------
----------------------------------------------------------------------------