Re: FW: CISCO ALERT - Cisco warns of holes in PIX firewalls
- From: "Thomas W Shinder" <tshinder@xxxxxxxxxxxxxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Tue, 23 Dec 2003 06:26:59 -0600
Hi Phil,
And a grenade kills 'em both :)
The point is that if you got Nachi, you lacked defense in depth and it
can't be blamed on the firewall. Same goes with the grenade :)
Tom
-----Original Message-----
From: Phill Hardstaff - SPC [mailto:phillh@xxxxxxx]
Sent: Tuesday, December 23, 2003 4:03 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] Re: FW: CISCO ALERT - Cisco warns of holes in PIX
firewalls
http://www.ISAserver.org
Nachi behind ISA kills it stone dead (just one infected machine is
enough), the point is every system has it's weaknesses, don't get too
cocky guys.
Maybe PIX handles Nachi OK :)
Cheers
Phill
----- Original Message -----
From: "Thomas W Shinder" <tshinder@xxxxxxxxxxxxxxxxxx>
To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
Sent: Tuesday, December 23, 2003 3:17 PM
Subject: [isalist] Re: FW: CISCO ALERT - Cisco warns of holes in PIX
firewalls
http://www.ISAserver.org
Hi Jim,
But but but but but but -- didn't you know that RDP was inherently
insecure, that that you need a Linux proxy if you ever hope to get any
level of security? I learned this valuable information from watch Dell
advertisements on TV, so it must be true. I was thinking of a method
where I could walk a floppy disk from one machine to another to make
sure that I was secure. I have to do it this way because the network
cables are unplugged.
HTH,
Tom
-----Original Message-----
From: Jim Harrison [mailto:jim@xxxxxxxxxxxx]
Sent: Monday, December 22, 2003 9:58 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] Re: FW: CISCO ALERT - Cisco warns of holes in PIX
firewalls
http://www.ISAserver.org
"I want HTTP administration of ISA Server"
Didn't we hear those words somewhere on this list and in the NG before?
I've also dealt with a customer that wanted SNMP management of ISA as
well.
..idiots..
:-(
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://www.microsoft.com/isaserver
http://isaserver.org/Jim_Harrison
http://isatools.org
Read the help, books and articles!
----- Original Message -----
From: "Thomas W Shinder" <tshinder@xxxxxxxxxxxxxxxxxx>
To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
Sent: Friday, December 19, 2003 12:48
Subject: [isalist] FW: CISCO ALERT - Cisco warns of holes in PIX
firewalls
http://www.ISAserver.org
So much for the miracle of the "hardware" firewall :-)
Network World's Cisco News Alert
Cisco warns of holes in PIX firewalls
By Paul Roberts
IDG News Service, 12/16/03
Network equipment maker Cisco is warning customers about security holes
in its PIX firewall product and firewall software that runs on the
Catalyst 6500 Series and 7600 Series switches.
Cisco issued two security advisories on Monday describing
vulnerabilities that could allow remote attackers to shut down Cisco
firewalls using HTTP or SNMP requests designed to exploit the
weaknesses.
Certain versions of the PIX firewall can be crashed and restarted in a
so-called denial-of-service (DoS) attack when they receive messages
using the SNMP version 3 (SNMPv3) protocol, an updated version of SNMP,
which allows organizations to monitor the status of network devices. PIX
firewalls do not support SNMPv3, Cisco said.
An SNMP server must be defined for the Cisco firewall in order for
SNMPv3 attack to succeed, Cisco said.
Catalyst switches running the Cisco Firewall Services Module
(FWSM) are also vulnerable to DoS attacks using SNMPv3, Cisco said. The
FWSM is software, based on the PIX Operating System, that allows Cisco
customers to use their high-performance Catalyst switches as firewalls.
In addition to the SNMPv3 vulnerability, a second buffer overflow
vulnerability discovered in the FWSM could allow a malicious hacker
using either RADIUS or TACACS+ to crash a Cisco firewall with a user
authentication request sent using HTTP, Cisco said. RADIUS and TACACS+
are both client/server protocols that allow remote access servers to
communicate with a central authentication server and authorize a remote
user's access to a requested network system or service.
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org Windows
Security Resource Site: http://www.windowsecurity.com/ Network Security
Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
jim@xxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org Windows
Security Resource Site: http://www.windowsecurity.com/ Network Security
Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
tshinder@xxxxxxxxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org Windows
Security Resource Site: http://www.windowsecurity.com/ Network Security
Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
phillh@xxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org Windows
Security Resource Site: http://www.windowsecurity.com/ Network Security
Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
tshinder@xxxxxxxxxxxxxxxxxx To unsubscribe send a blank email to
$subst('Email.Unsub')
Other related posts:
