Patching for Cisco vulnerability

Valdis.Kletnieks at vt.edu Valdis.Kletnieks at vt.edu
Fri Jul 18 19:10:43 UTC 2003


On Fri, 18 Jul 2003 12:29:30 MDT, Irwin Lazar <ILazar at burtongroup.com>  said:

> I'm trying here to gauge the length of time before this vulnerability is closed out.

The core routers have been bouncing as they upgrade all this week.  A lot of places
will be putting the fixes in place during windows this weekend.

And some 30% of the routers won't ever get upgraded.  We're going to be finding
vulnerable routers on eBay for years.

See Eric Rescorla's paper on how fast the OpenSSL vulnerabilities of a while ago
were actually fixed:

To: 	BugTraq
Subject: 	Security holes... Who cares?
Date: 	Nov 15 2002 6:30PM
Author: 	Eric Rescorla <ekr rtfm com>
Message-ID: 	<200211151830.gAFIUr751517 at sierra.rtfm.com>

I'd like to announce the availability for downlaod of the following
paper.

                      Security holes... Who cares?

                              Eric Rescorla
                      RTFM, Inc.   <http://www.rtfm.com/>

We report on an observational study of user response following the
OpenSSL remote buffer overflows of July 2002 and the worm that exploited
it in September 2002.  Immediately after the publication of the bug and
its subsequent fix we identified a set of vulnerable servers. In the
weeks that followed we regularly probed each server to determine whether
it had applied one of the relevant fixes. We report two primary
results. First, we find that administrators are generally very slow to
apply the fixes. Two weeks after the bug announcement, more than two
thirds of servers were still vulnerable. Second, we identify several
weak predictors of user response and find that the pattern differs in
the period following the release of the bug and that following the
release of the worm.

The paper can be downloaded from:
http://www.rtfm.com/upgrade.pdf
http://www.rtfm.com/upgrade.ps


-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20030718/05af3617/attachment.sig>


More information about the NANOG mailing list