By the way anyone trying to actually reproduce/test this just use Debian 10
because they have the DECnet for Linux tools in a deb already and it wouldn't
compile on an RPM based system.
-Drew
-Original Message-
From: cisco-nsp On Behalf Of Drew Weaver
Sent: Friday, August 6, 2021
Yes,
Plus consider the fact that if you do a 'show users' it shows up as a VTY
connection and if you set transports on your configuration interfaces (console)
it ignores that and still works.
-Drew
-Original Message-
From: cisco-nsp On Behalf Of Randy (K6RP)
Sent: Friday, August 6,
For something that is answering by default, where brutes cannot be
blocked or ratelimited by CoPP or MLS kbobs? Control plane DDoS
anyone?
What other surprises are in it's codes?
I'm sure a (hopefully) whitehat would have fun with this one.
---
~Randy (K6RP)
On 08/06/2021 9:00 am, Drew
AAA was unconfigured as I was testing on a lab router.
Whether or not it provides unauthorized access depends on whether you expect
anyone that has something connected to that router to have access to the
console or not.
At the very least it provides an opportunity and a vector.
It doesn't
--- Begin Message ---
On Fri, Aug 06, 2021 at 02:00:30PM +0200, Lukas Tribus wrote:
> I'm no longer putting in hundreds of hours to fight losing battles,
> which earlier in my carrier I did:
>
Hi,
On Fri, Aug 06, 2021 at 02:00:30PM +0200, Lukas Tribus wrote:
> I'm no longer putting in hundreds of hours to fight losing battles,
> which earlier in my carrier I did:
> https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140828-CVE-2014-3347
Ensuring that MOP
On Fri, 6 Aug 2021 at 09:59, James Bensley
wrote:
> > What is right or technically correct is not always the priority.
>
> This is the job we do, right? (it's the job I do anyway). We find a
> way to convince the powers that be, that this is a massive security
> risk for example, or for example
Okay my concern overall is not that it is in IOS 12. It's that it is in IOS XE
and (possibly) other images.
Is there a list somewhere of what images support it? If not there probably
should be.
-Original Message-
From: Hunter Fuller
Sent: Thursday, August 5, 2021 3:49 PM
To: Drew
On Thu, 5 Aug 2021 at 22:47, Lukas Tribus wrote:
>
> On Thu, 5 Aug 2021 at 21:49, Nick Hilliard wrote:
> > It has the appearance of a feature which is kept alive because some
> > customer with a huge spend demands it in general-deployment release
> > trains (this is idle speculation and may be
