Can I ask a stupid question? What about the cat6.5k that ceilings out at 12.2(33)SXI2? Is this special case?
-b ________________________________________ From: [email protected] [[email protected]] On Behalf Of ML [[email protected]] Sent: Wednesday, September 23, 2009 2:13 PM To: Gert Doering Cc: Cisco Systems Product Security Incident Response Team; [email protected]; Wendy Garvin Subject: Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software Tunnels Vulnerability > [..] >> The source and destination address must be the configured tunnel >> addresses. The source address does matter, but it is possible to spoof >> it. The destination address cannot be any address on the box, it must be >> the configured destination address. However, you must take into account >> that the source address could be spoofed. > > Now *this* is certainly good news. Since the devices in question (which > can't easily be upgraded to 12.4) only have a single tunnel with a > tunnel destination that is inside our network, anti-spoofing ACLs to > "peers and upstreams" are already in place, and customers get uRPF > anyway. > > So we're just not upgrading, and when the hardware breaks, we'll decide > what to buy as a replacement. > > gert I've read this passage multiple times and I want to clear this up. The malicious packet *must* contain the actual tunnel source and destination address. Anything else and the attack is ineffective. -ML _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
