Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-04-01 Thread Clay Kossmeyer
Hi All - The Cisco PSIRT has been sending IOS Security Advisories to the NANOG mailing list for well over a decade. We started this process a long time ago at the request of the list’s then-membership and haven’t been asked to change since. Admittedly, vulnerability

RE: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-04-01 Thread Chuck Church
Software SSL VPN Denial of Service Vulnerability Hi All - The Cisco PSIRT has been sending IOS Security Advisories to the NANOG mailing list for well over a decade. We started this process a long time ago at the request of the list's then-membership and haven't been asked to change since. Admittedly

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-04-01 Thread Valdis . Kletnieks
On Tue, 01 Apr 2014 15:24:32 -0400, Chuck Church said: Given that probably 80+% (a guess, but I'd be really surprised at a lower figure) of all internet traffic crosses at least one Cisco device somewhere, I think it would be a huge disservice to discontinue sending these emails. Actually, the

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-04-01 Thread Scott Weeks
--- ckoss...@cisco.com wrote: From: Clay Kossmeyer ckoss...@cisco.com [...] we’re happy to discontinue sending to the NANOG list directly. -- Instead of discontinuing them how about one email that contains all the details, rather than one

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-04-01 Thread Brandon Butterworth
The Cisco PSIRT has been sending IOS Security Advisories to the NANOG mailing list for well over a decade Thank you, much appreciated Given that there are a number of forums that more directly address either Cisco-specific issues or are specific to vulnerability announcements, we’re happy

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-04-01 Thread Ted Hatfield
On Tue, 1 Apr 2014, Brandon Butterworth wrote: The Cisco PSIRT has been sending IOS Security Advisories to the NANOG mailing list for well over a decade Thank you, much appreciated Given that there are a number of forums that more directly address either Cisco-specific issues or are specific

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-04-01 Thread Mike
On 04/01/2014 11:44 AM, Clay Kossmeyer wrote: Hi All - The Cisco PSIRT has been sending IOS Security Advisories to the NANOG mailing list for well over a decade. We started this process a long time ago at the request of the list’s then-membership and haven’t been asked to change since.

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-04-01 Thread Randy
From: Clay Kossmeyer ckoss...@cisco.com To: nanog@nanog.org Cc: Clay Seaman-Kossmeyer (ckossmey) ckoss...@cisco.com Sent: Tuesday, April 1, 2014 11:44 AM Subject: Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability Hi All - The Cisco PSIRT has been

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-03-28 Thread Mark Tinka
On Friday, March 28, 2014 05:48:29 AM Shrdlu wrote: Why? Personally, I think it's fine. It only happens (at most) every six months (and sometimes more like a year). I think it's fine too. As I'm sure you know, if you're a Cisco customer, you can subscribe to their internal notification

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-03-27 Thread kendrick eastes
The Full-disclosure mailing list was recently... retired, I guess cisco thought NANOG was the next best place. On Wed, Mar 26, 2014 at 10:45 AM, rw...@ropeguru.com rw...@ropeguru.comwrote: Is this normal for the list to diretly get Cisco security advisories or something new. First time I

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-03-27 Thread cbr
For anyone who was subscribed to the old full-disclosure list ... Fydor of nmap has brought it back to life. Infolink @ http://insecure.org/news/fulldisclosure/ Subscribe @ http://nmap.org/mailman/listinfo/fulldisclosure On Mar 26, 2014, at 10:52 AM, kendrick eastes keas...@gmail.com wrote:

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-03-27 Thread Matt Palmer
On Wed, Mar 26, 2014 at 10:52:42AM -0600, kendrick eastes wrote: The Full-disclosure mailing list was recently... retired, I guess cisco thought NANOG was the next best place. Nope, they've been sending these things here for as long as I can remember. I have NFI why -- probably hubris,

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-03-27 Thread Larry Sheldon
On 3/27/2014 4:07 PM, Matt Palmer wrote: On Wed, Mar 26, 2014 at 10:52:42AM -0600, kendrick eastes wrote: The Full-disclosure mailing list was recently... retired, I guess cisco thought NANOG was the next best place. Nope, they've been sending these things here for as long as I can remember.

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-03-27 Thread Alexander Neilson
I wonder if they should be invited to only post a single message with the titles and links to the alerts so that people can follow it up. They should also include a link to their own list that they send the full alerts to. That way there could be some headline alerting to people that there is

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-03-27 Thread Shrdlu
On 3/27/2014 7:44 PM, Alexander Neilson wrote: I wonder if they should be invited to only post a single message with the titles and links to the alerts so that people can follow it up. Why? Personally, I think it's fine. It only happens (at most) every six months (and sometimes more like a

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-03-27 Thread Randy Bush
Alexander Neilson alexan...@neilson.net.nz wrote: I wonder if they should be invited to only post a single message with the titles and links to the alerts so that people can follow it up. i would prefer that the header be in blue, the titles in green, and the urls in magenta, in comic sans, of

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-03-27 Thread Larry Sheldon
On 3/27/2014 11:57 PM, Randy Bush wrote: Alexander Neilson alexan...@neilson.net.nz wrote: I wonder if they should be invited to only post a single message with the titles and links to the alerts so that people can follow it up. i would prefer that the header be in blue, the titles in green,

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-03-27 Thread Peter Kristolaitis
On 3/28/2014 12:57 AM, Randy Bush wrote: Alexander Neilson alexan...@neilson.net.nz wrote: I wonder if they should be invited to only post a single message with the titles and links to the alerts so that people can follow it up. i would prefer that the header be in blue, the titles in green,

Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-03-26 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cisco IOS Software SSL VPN Denial of Service Vulnerability Advisory ID: cisco-sa-20140326-ios-sslvpn Revision 1.0 For Public Release 2014 March 26 16:00 UTC (GMT) Summary === A vulnerability in the Secure Sockets Layer (SSL) VPN subsystem of

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-03-26 Thread rw...@ropeguru.com
Is this normal for the list to diretly get Cisco security advisories or something new. First time I have seen these. Robert On Wed, 26 Mar 2014 12:10:00 -0400 Cisco Systems Product Security Incident Response Team ps...@cisco.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cisco

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-03-26 Thread james
Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability Is this normal for the list to diretly get Cisco security advisories or something new. First time I have seen these. Robert On Wed, 26 Mar 2014 12:10:00 -0400 Cisco Systems Product Security Incident Response Team ps

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-03-26 Thread Mikael Abrahamsson
On Wed, 26 Mar 2014, rw...@ropeguru.com wrote: Is this normal for the list to diretly get Cisco security advisories or something new. First time I have seen these. They do this twice a year, all their advisories were sent here about half a year ago as well. -- Mikael Abrahamssonemail:

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-03-26 Thread Andrew Latham
Robert Perfectly normal, almost an announce list for issues like this. On Wed, Mar 26, 2014 at 12:45 PM, rw...@ropeguru.com rw...@ropeguru.com wrote: Is this normal for the list to diretly get Cisco security advisories or something new. First time I have seen these. Robert On Wed, 26 Mar

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-03-26 Thread rw...@ropeguru.com
Thanks everyone for the replies. I guess since they are done so infrequently, I was not a list member the last go around. Robert On Wed, 26 Mar 2014 12:58:44 -0400 Andrew Latham lath...@gmail.com wrote: Robert Perfectly normal, almost an announce list for issues like this. On Wed, Mar

Re: Cisco Security Advisory: Cisco IOS Software SSL VPN Denial of Service Vulnerability

2014-03-26 Thread Justin M. Streiner
These also get posted to other mailing lists, such as cisco-nsp. jms On Wed, 26 Mar 2014, rw...@ropeguru.com wrote: Thanks everyone for the replies. I guess since they are done so infrequently, I was not a list member the last go around. Robert On Wed, 26 Mar 2014 12:58:44 -0400 Andrew