On Mon, 2010-08-30 at 17:04 -0400, Keegan Holley wrote: > Is anyone else curious as to what fields/attributes they were using? > Also, what other vendors are or aren't affected. I think the response > to this even has been remarkably limited given the possibility for > it's use as an attack. If this were windows or linux there would have > been full disclosure with example exploit code by now. Everyone seems > to be content just upgrading their quarter million dollar routers and > hoping for the best.
According to an article in a local (in Denmark) online news site they have avoided full disclosure because of possible legal implications. Translated from the article: " It is not clear why the RIPE NCC and Duke tried these new " [attributes]. " " One of the researchers behind the experiment, assistant professor from " Duke University Xiaowei Yang, refuses to talk about the details behind " the experiment for legal reasons. http://epn.dk/teknologi2/computer/sikkerhed/article2167247.ece Anybody know if they have this right? RIPE have issued an official statement, but (AFAICT) have not taken part in the ongoing discussion e.g. found on NANOG-ML. -- Peter > > 2010/8/30 Antonio Soares <[email protected]> > > > Now that i have more information I can tell you that you are 100% correct. > > So let's upgrade the IOS-XR devices first then those running IOS. I'm > > curious to see if the IOS issue is a known or new bug. > > > > > > Regards, > > > > Antonio Soares, CCIE #18473 (R&S/SP) > > [email protected] > > > > > > -----Original Message----- > > From: [email protected] > > [mailto:[email protected]] On Behalf Of Lukasz Bromirski > > Sent: segunda-feira, 30 de Agosto de 2010 00:18 > > To: [email protected] > > Subject: Re: [c-nsp] Research experiment disrupts Internet, for some > > > > On 2010-08-29 19:59, Jared Mauch wrote: > > > > > IOS-XR had a bug processing valid bgp updates. This has happened > > > in the past as well with 4-byte ASNs and other things over the > > > years. > > > > [...] > > > > > If the software is old, they likely saw a bug. If you don't > > > maintain your BGP speaking devices software revisions, you will > > > likely see problems. > > > > What's most propable IMHO is that the GSR dropped the session to > > BGP-speaker which was indeed IOS-XR box, then dCEF ran out of > > memory on the LCs (for example because of memory fragmentation or > > some bug indeed) and the issue happened. > > > > This is of course based on incomplete data - if there was any > > session directly established to IOS-XR box for starters. > > > > -- > > "Everything will be okay in the end. | Łukasz Bromirski > > If it's not okay, it's not the end." | http://lukasz.bromirski.net > > _______________________________________________ > > cisco-nsp mailing list [email protected] > > https://puck.nether.net/mailman/listinfo/cisco-nsp > > archive at http://puck.nether.net/pipermail/cisco-nsp/ > > > > > > _______________________________________________ > > cisco-nsp mailing list [email protected] > > https://puck.nether.net/mailman/listinfo/cisco-nsp > > archive at http://puck.nether.net/pipermail/cisco-nsp/ > > > > > > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
