Patching for Cisco vulnerability

Fri Jul 18 19:32:05 UTC 2003

On Fri, 2003-07-18 at 14:29, Irwin Lazar wrote:
> Just out of curiosity, are folks just applying the Cisco patch or do
> you go through some sort of testing/validation process to ensure that
> the patch doesn't cause any other problems?  Given typical change
> management procedures how long is taking you to get clearance to apply
> the patch?

I think a lot of providers are doing the minimum testing required
(upgrade, does it boot?  can I ping?) and then rolling it out...  I
guess it's more of an implicit trust type deal rather than having
routers running with an increased load because of ACL's and still having
the possibility of a vulnerable router because something was
overlooked..  

Going forward, if you go the ACL route, every time you add a new
interface you need to be sure to either apply the "any any" acl to it,
or add the new ip's to the "big" block by ip acl ...

> I'm trying here to gauge the length of time before this vulnerability
> is closed out.

I don't think it will ever truly go away..  there are lots of "older"
routers that won't be able to support the newer code, albeit small
routers like the 2500's, but they'll exist..

> irwin

-- 
---------------------------
Jason H. Frisvold
Backbone Engineering Supervisor
Penteledata Engineering
friz at corp.ptd.net
RedHat Engineer - RHCE # 807302349405893
Cisco Certified - CCNA # CSCO10151622
MySQL Core Certified - ID# 205982910
---------------------------
"Imagination is more important than knowledge.
Knowledge is limited. Imagination encircles
the world."
      -- Albert Einstein [1879-1955]
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20030718/6568a1d6/attachment.sig>