RE: Cisco PIX embryonic state machine TTL(n-1) DoSand Cisco PIX embryonic state machine 1b data DoS

["alex" <pigrelax () yandex ru>]

Both cases are bad example. First case demonstrates Cisco routers internal
architecture, not vulnerability. In second case vulnerability was in CGI Web
application Cisco uses on corporate site, not in Cisco product. It was
promptly patched immediately after vendor contact.


-----Original Message-----
From: full-disclosure-bounces () lists grok org uk
[mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of Georgi
Guninski
Sent: Tuesday, March 07, 2006 10:49 PM
To: Randy Ivener (rivener)
Cc: full-disclosure () lists grok org uk
Subject: Re: [Full-disclosure] Cisco PIX embryonic state machine TTL(n-1)
DoSand Cisco PIX embryonic state machine 1b data DoS

On Tue, Mar 07, 2006 at 11:05:04AM -0800, Randy Ivener (rivener) wrote:
> We greatly appreciate the opportunity to work with researchers on
> security vulnerabilities, and welcome the opportunity to review and
> assist in product reports.

indeed, you really appreciate it:

http://www.schneier.com/blog/archives/2005/07/cisco_harasses.html
Cisco threatened legal action to stop the conference's organizers from
allowing a 24-year-old researcher for a rival tech firm to discuss how he
says hackers could seize control of Cisco's Internet routers, which dominate
the market.

http://www.eweek.com/article2/0,1895,1843451,00.asp
Cisco has initiated system-wide resets of user passwords and patched the
search tool flaw, he added.

-- 
where do you want bill gates to go today?
 
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/