nanog mailing list archives
Re: Cisco cover up
From: "Stephen J. Wilcox" <steve () telecomplete co uk>
Date: Thu, 28 Jul 2005 15:43:46 +0100 (BST)
On Wed, 27 Jul 2005, James Baldwin wrote:
Cisco had initially approved this talk. My understanding is that this has been fixed and no current IOS images were vulnerable to the techniques he was describing. ISS, Lynn, and Cisco had been working together for months on this issue before the talk.
Just because they fixed the bugs doesnt mean there arent a large number of publically accessible routers out there still running affected versions.. I suspect there was something slightly more than just giving information about the vulnerabilities.. the inference is that they demonstrated executing arbitrary code from buffer overflows.. perhaps for example they developed ways of opening up privilege vty which I dont think has been shown before Steve
Current thread:
- Cisco cover up J. Oquendo (Jul 27)
- Re: Cisco cover up James Baldwin (Jul 27)
- Re: Cisco cover up Stephen J. Wilcox (Jul 28)
- Re: Cisco cover up Randy Bush (Jul 28)
- Re: Cisco cover up Stephen J. Wilcox (Jul 28)
- Re: Cisco cover up Mark Owen (Jul 28)
- Re: Cisco cover up Mikael Abrahamsson (Jul 28)
- Re: Cisco cover up james edwards (Jul 28)
- RE: Cisco cover up Robert Crowe (Jul 28)
- RE: Cisco cover up James Edwards (Jul 28)
- Re: Cisco cover up Mikael Abrahamsson (Jul 28)
- Re: Cisco cover up Stephen Sprunk (Jul 28)
- Re: Cisco cover up James Baldwin (Jul 27)
- Re: Cisco cover up Chris Adams (Jul 28)
- <Possible follow-ups>
- RE: Cisco cover up Olsen, Jason (Jul 27)
- Re: Cisco cover up Joseph S D Yao (Jul 28)