Full Disclosure mailing list archives
Re: Should nmap cause a DoS on cisco routers?
From: Mailing lists at Core Security Technologies <lists () coresecurity com>
Date: Fri, 02 Jul 2010 16:05:37 -0300
Hello Mr. Dobbins. Normally, I'd not reply to this post but something about it prompted me to do it. Dobbins, Roland wrote:
On Jul 2, 2010, at 7:01 AM, Dan Kaminsky wrote:Permanent DoS's are unacceptable even from intentionally malicious traffic, let alone a few nmap flags. They're unacceptable to us, they're unacceptable to Microsoft (see: MSRC bug bar), and even Cisco PSIRT has shown up on thread desiring to clean things up.Again, causing the RP CPU to go to 100% due to punted management-plane traffic isn't a new phenomenon - it's well-understood amongst network operators, as are BCPs which mitigate the risk of such an occurrence.
This is an obvious fallacy. Here's why: You've unilaterally decided that your interpretation of the original message from Shang Tsung is the correct one. Namely that what caused the devices to *crash and reboot* was the amount of traffic they were receiving on the SNMP ports. His email did not state such thing. Then on the basis of taking your own assumption as truth and not based on factual data you then proceed to dismiss the problem as nothing new or worthy of discussion but simply a matter of improper configuration or network architecture. You may or may not be wrong but at this point in the thread and without actual evidence (packet dumps, repro steps, something@!#) it's simply anybody's guess what actually happened to Mr. Shang's networking devices of unknown brands and models, running unknown firmware. You and others then proceeded to implicitly assume that Mr. Shang's devices are in fact Cisco gear by speculating about what PSIRT should or should not do (Juniper's team is called SIRT, 3Com's is SRT and HUawei's is NSIRT...) Now, further down the email thread somebody from Cisco's PSIRT actually chimed in (hola Dario!) asking for technical details. Perhaps we should too ask and wait for actual data from Mr. Shang and defer for later the construction of hypothetical explanations that are as robust as a brazilian soccer team with a 1 goal lead. -ivan _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Should nmap cause a DoS on cisco routers?, (continued)
- Re: Should nmap cause a DoS on cisco routers? Lee (Jul 01)
- Re: Should nmap cause a DoS on cisco routers? Dobbins, Roland (Jul 01)
- Re: Should nmap cause a DoS on cisco routers? Dan Kaminsky (Jul 01)
- Re: Should nmap cause a DoS on cisco routers? AMILABS (Jul 02)
- Re: Should nmap cause a DoS on cisco routers? Thierry Zoller (Jul 02)
- Re: Should nmap cause a DoS on cisco routers? Dobbins, Roland (Jul 02)
- Re: Should nmap cause a DoS on cisco routers? Thierry Zoller (Jul 02)
- Re: Should nmap cause a DoS on cisco routers? Dobbins, Roland (Jul 02)
- Re: Should nmap cause a DoS on cisco routers? Dobbins, Roland (Jul 02)
- Re: Should nmap cause a DoS on cisco routers? Dan Kaminsky (Jul 02)
- Re: Should nmap cause a DoS on cisco routers? Mailing lists at Core Security Technologies (Jul 02)
- Re: Should nmap cause a DoS on cisco routers? Dobbins, Roland (Jul 02)
- Re: Should nmap cause a DoS on cisco routers? Fyodor (Jul 06)
- Re: Should nmap cause a DoS on cisco routers? coderman (Jul 07)
- Re: Should nmap cause a DoS on cisco routers? Benji (Jul 08)
- Message not available
- Re: Should nmap cause a DoS on cisco routers? coderman (Jul 08)
- Re: Should nmap cause a DoS on cisco routers? Florian Weimer (Jul 02)
- Re: Should nmap cause a DoS on cisco routers? Dobbins, Roland (Jul 02)
- Re: Should nmap cause a DoS on cisco routers? Thierry Zoller (Jul 02)
- Re: Should nmap cause a DoS on cisco routers? Champ Clark III [Softwink] (Jul 02)
- Re: Should nmap cause a DoS on cisco routers? Christian Sciberras (Jul 02)