Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software RSVP Vulnerability

2014-09-25 Thread b.turn...@twt.it
Hi Dario, please see inline Thank you to PSIRT for generally thorough advisories. :-) I have a grievance though: The Cisco IOS Software section of Software Versions and Fixes not longer includes a comprehensive list of affected IOS releases but instead refers to the IOS Software

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software RSVP Vulnerability

2014-09-25 Thread Peter Rathlev
On Wed, 2014-09-24 at 15:12 -0400, Dario Ciccarone wrote: Actually, we think that may be because you're using option a - typing in an IOS release, or selecting from the list. You can instead use option b (and paste the output of multiple show version commands) or option c (and provide a list

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software RSVP Vulnerability

2014-09-25 Thread Lukas Tribus
Hi, IOS Software Checker is a nice tool, do keep it. But for the helicopter view the comprehensive list is a really great help. And it's no problem that the list is a snapshot at publication time. The fast response to a serious vulnerability is the hours or days immediately after the

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software RSVP Vulnerability

2014-09-25 Thread Nick Hilliard
On 25/09/2014 11:25, Lukas Tribus wrote: Yes, the software checker is extremely useful (when I have one or multiple specific IOS releases and I want to know the advisories), but not the other way around (when I know the advisory and need to understand the impact on my network). +1 Please

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software RSVP Vulnerability

2014-09-25 Thread Gert Doering
Hi, On Thu, Sep 25, 2014 at 11:35:01AM +0200, Peter Rathlev wrote: IOS Software Checker is a nice tool, do keep it. But for the helicopter view the comprehensive list is a really great help. This! +1 gert -- USENET is *not* the non-clickable part of WWW!

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software RSVP Vulnerability

2014-09-25 Thread Clay Seaman-Kossmeyer (ckossmey)
Hi Folks - We definitely appreciate the feedback and will put some thought into how we can satisfy this request. Behind the scenes, we’ve moved to a very different infrastructure for compiling vulnerability information for each IOS release, which allows us to greatly improve our ability to

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software RSVP Vulnerability

2014-09-25 Thread Justin M. Streiner
IOS Software Checker is a nice tool, do keep it. But for the helicopter view the comprehensive list is a really great help. And it's no problem that the list is a snapshot at publication time. The fast response to a serious vulnerability is the hours or days immediately after the advisory has

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software RSVP Vulnerability

2014-09-25 Thread Reuben Farrelly via cisco-nsp
Another similar change I've noticed recently in so far as release notes and details of changes go is this - release notes for 15.1(4)M9: http://www.cisco.com/c/en/us/td/docs/ios/15_1/release/notes/15_1m_and_t/151-4MCAVS.html#pgfId-62747 All resolved bugs for this release are available in the

[c-nsp] Cisco Security Advisory: Cisco IOS Software RSVP Vulnerability

2014-09-24 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cisco IOS Software RSVP Vulnerability Advisory ID: cisco-sa-20140924-rsvp Revision 1.0 For Public Release 2014 September 24 16:00 UTC (GMT) Summary +== A vulnerability in the implementation of the Resource Reservation Protocol (RSVP) in

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software RSVP Vulnerability

2014-09-24 Thread Peter Rathlev
On Wed, 2014-09-24 at 12:23 -0400, Cisco Systems PSIRT wrote: Cisco IOS Software RSVP Vulnerability ... Thank you to PSIRT for generally thorough advisories. :-) I have a grievance though: The Cisco IOS Software section of Software Versions and Fixes not longer includes a comprehensive list of

Re: [c-nsp] Cisco Security Advisory: Cisco IOS Software RSVP Vulnerability

2014-09-24 Thread Dario Ciccarone
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Peter: Thanks for your feedback ! Please see inline for some additional comments: On 9/24/14 2:55 PM, Peter Rathlev wrote: On Wed, 2014-09-24 at 12:23 -0400, Cisco Systems PSIRT wrote: Cisco IOS Software RSVP Vulnerability ... Thank you to