[Tfug] Cisco 600 series.

[Jon]

These vulnerbilities don't really suprise me though. It's not IOS. Plain
and simple. This is an OS that was designed, to the best of my knowledge,
by another company that Cisco bought out back in '98.

At this point Cisco is just trying to live with it until no one uses it
anymore (I believe it has been EOL'd). If I were to use DSL I
would purchase the 827 which is a true Cisco product. It costs more but I
would bet that it will never have the problems the 600 series has had.

Jon


On Tue, 4 Jun 2002, Chris Hilton wrote:

> On Tue, 4 Jun 2002 10:48:42 -0700 (MST)
> "Jon" <bigj@flatwan.net> wrote:
>
> > Nice article about the Cisco series 600 running CBOS and it's huge
> > vulnerbilities. Article is new but I think most of us know about some
> > of these already. In any case here it is:
> >
> > http://www.cisco.com/warp/public/707/CBOS-DoS.shtml
> >
> >
> > Jon
>
> Jon-
>
> You can fix all the vulnerabilities in this article (and a couple more)
> by upgrading to cbos 2.4.5 which Qwest has (finally)  so graciously
> (sic) made available on their dsl customer support website.  The article
> doesn't even cover all the vulnerabilities current at the time it was
> written.  The release notes for the cbos upgrade list include these as
> well:
>
> Resolved Issues
> ===========
>
>  -  CSCdv09928
>     CBOS parser allows invalid port numbers to be specified
>
>  -  CSCdv06092
>     Web services will respond to a directed broadcast request on subnet
>
>  -  CSCdx16962
>     ppp memory utilization increase after multiple train cycles
>
>  -  CSCdx35237
>     large packet causes PPP termination, incorrect EchoReq timer
>
>  -  CSCdx36121
>     TCP memory exhaustion after receiving large packet
>
>  -  CSCdx51594
>     DHCP lease expiration timer not decrementing properly
>
>  -  CSCdx61253
>     Bridging mode fails when certain configurations enabled
>
> Add one or two that weren't made public and maybe they got em all for
> now.  Heh.
>
> -C-
> _______________________________________________
> tfug mailing list
> tfug@tfug.org
> https://www.tfug.org/mailman/listinfo/tfug
>