Onderwerp: Addressing Cisco Security Issues

I have to post this because I consider this to be a security issue in it's
own right.

Recently there were a number of exploits released for cisco equipment, among
the affected equipment were the 677 and 678 consumer DSL routers of which
there are millions in use.

I have one such router, the DSL circuit is provided by Alltel and I work for
the ISP who provides the actual internet access.

So upon reading recent warning notice sent to the security email lists about
the exploits being publicly available I went and read
http://www.cisco.com/warp/public/707/CBOS-DoS.shtml which pretty much says
any router running a version of CBOS prior to 2.4.5 (actually you need 2.4.6
because of later exploits) is vulnerable.

So like a good netizen I contacted cisco TAC via telephone, gave them my 678
serial number and they informed me that they could not provide the security
update because my router is registered to alltel (alltel did provide the
router when I ordered the DSL circuit), please call Alltel to get it. Ok so
then I called Alltel, who told me no problem we can email you the update and
asked for my email address. Except since Alltel is not the ISP I don't have
an alltel email address so then they won't email it to me, please contact
your ISP. I then informed Alltel that I AM MY ISP to which they replied they
still could not provide the patch and that I would have to get it from
Cisco.

So then I call Cisco TAC again, this time I explain the full details of all
I've just been thru and the tech decides to ask someone. Comes back and says
if I register on the cisco website that he can open a ticket and get someone
to call me back on it. (I'm presently waiting for that call)

In the mean time I decided to google for it and low and behold I found 2.4.6
on a website (url not posted to protect the life saving individuals who put
it on the web). Now of course I've no way to know if this version I just
found is safe or not but HELLO CISCO???

If you are going to issue security alerts that require ISP's and consumers
to patch their hardware devices then you had better damn well make sure that
folks can actually GET THE PATCHES. It would require no effort at all to
post a bogus version full of back doors and whatnot on the web and after
seeing the nightmare it is to obtain the patch thru official channels it's
clear to me that this would be a very popular download.

Geo.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hello -

I can appreciate your frustration with not being able to download
fixed software for your 678. As you've discovered, the Cisco TAC
doesn't normally directly support DSL modems that were provided by an
ISP. The TAC process for this is to direct customers to their ISP for
downloads. The reasons for this are many, but one of the major ones
is that SPs/ISPs want to control what versions of software are
deployed within their networks.

Having said that, there is an exception and escalation process for
situations like yours. If you've attempted to contact your
reseller/ISP and have been unsuccessful -- as in this case -- the TAC
can and should open a TAC case for you. At this point, you should be
provided a TAC case number.

Cisco TAC cases are assigned priority levels that correspond to the
severity and urgency of the problem. The priority level also
determines the amount of time in which you can expect a response from
a TAC engineer. When you contact TAC, work with them to set the
correct priority level for your issue. Also, make sure to ask when
you can expect a response so everyone's expectations are set up front.

If you feel as though your case is not being addressed urgently
enough, you can call the TAC at any time, referencing your case
number, to have the priority raised or the case escalated further.

In the future, if you believe you've run into a Cisco security related
issue, you can contact psirt@cisco.com or security-alert@cisco.com.
If needed, you can find additional ways to contact TAC here:

http://www.cisco.com/warp/public/687...y/DirTAC.shtml

I'll follow up with you unicast and we can figure out which image
you'll need.

Clay

- --
Clay Seaman-Kossmeyer - Cisco PSIRT
- --------------------------------------
http://www.cisco.com/go/psirt


On Mon, Mar 29, 2004 at 01:02:25PM -0500, Geo. wrote:
>I have to post this because I consider this to be a security issue in
>it's own right.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (SunOS)

iD8DBQFAaKpUEHa/Ybuq8nARAvI/AKCuC2ri1bltt8QgjzdDr9c5x+TMsgCfdfws
I0cTaCGL1Q9BW9Y+I+0MJLE=
=gbkK
-----END PGP SIGNATURE-----