<div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)">Hola,</div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)">Juniper veo que liberó ayer por lo menos para la rama recomendada en los MX un fix. </div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)">En CISCO veo que sigue en categoría de bug y con un workaround manual basado en ACL:</div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)"><br></div><div class="gmail_default"><font color="#000000" face="tahoma, sans-serif"><a href="https://quickview.cloudapps.cisco.com/quickview/bug/CSCva94139" target="_blank">https://quickview.cloudapps.<wbr>cisco.com/quickview/bug/<wbr>CSCva94139</a></font><br></div><div class="gmail_extra"><br></div><div class="gmail_extra"><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)">Saludos.</div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small;color:rgb(0,0,0)"><br></div><br><div class="gmail_quote">2016-08-15 15:04 GMT-03:00 Azael Fernandez Alcantara <span dir="ltr"><<a href="mailto:afaza@unam.mx" target="_blank">afaza@unam.mx</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Buen Dia,<br>
<br>
Tambien puede servir lo comentado en la sig. liga:<br>
<br>
<a href="https://www.insinuator.net/2016/05/cve-2016-1409-ipv6-ndp-dos-vulnerability-in-cisco-software/" rel="noreferrer" target="_blank">https://www.insinuator.net/201<wbr>6/05/cve-2016-1409-ipv6-ndp-<wbr>dos-vulnerability-in-cisco-<wbr>software/</a><br>
<br>
<br>
SALUDOS<br>
_______<br>
Azael<br>
____________________________<br>
Mensaje enviado sin acentos<div class="HOEnZb"><div class="h5"><br>
<br>
<br>
On Sun, 14 Aug 2016, Fernando Gont wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
FYI.<br>
<br>
Aparentemente, algunos dispositivos no descartan los paquetes de ND<br>
recibidos cuando el Hop Limit != 255.<br>
<br>
Esto, sumado a que implementar "ARP" sobre IP (como es el caso de ND)<br>
permite que dicho trafico sea ruteable, lleva a cosas como estas.<br>
<br>
En fin...<br>
<br>
<br>
-------- Forwarded Message --------<br>
Subject: CVE-2016-1409: IPv6 Neighbor Discovery Crafted Packet Denial of<br>
Service Vulnerability<br>
Date: Wed, 10 Aug 2016 17:52:16 +0000<br>
From: Suresh Krishnan <<a href="mailto:suresh.krishnan@ericsson.com" target="_blank">suresh.krishnan@ericsson.com</a>><br>
To: IETF IPv6 Mailing List <<a href="mailto:ipv6@ietf.org" target="_blank">ipv6@ietf.org</a>>, IPv6 Operations<br>
<<a href="mailto:v6ops@ops.ietf.org" target="_blank">v6ops@ops.ietf.org</a>>, <a href="mailto:6man-chairs@ietf.org" target="_blank">6man-chairs@ietf.org</a> <<a href="mailto:6man-chairs@ietf.org" target="_blank">6man-chairs@ietf.org</a>>,<br>
<a href="mailto:v6ops-chairs@ietf.org" target="_blank">v6ops-chairs@ietf.org</a> <<a href="mailto:v6ops-chairs@ietf.org" target="_blank">v6ops-chairs@ietf.org</a>><br>
<br>
Hi all,<br>
I have been notified about this vulnerability and have been asked<br>
whether this is due to an issue with the IPv6 protocol specifications.<br>
At first glance, I have a hard time seeing how this attack is possible<br>
on any compliant RFC4861 implementation given that the 255 Hop Limit<br>
check would drop any remote attack packets. If someone on the 6man/v6ops<br>
mailing lists has further info, can you please contact me off-list. My<br>
goal is to figure out if there is any protocol work or operational<br>
guidance needed from the IETF side.<br>
<br>
More info:<br>
<br>
This is the CVE list entry in question<br>
<br>
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1409" rel="noreferrer" target="_blank">https://cve.mitre.org/cgi-bin/<wbr>cvename.cgi?name=CVE-2016-1409</a><br>
<br>
The Cisco security advisory<br>
<br>
<a href="https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160525-ipv6" rel="noreferrer" target="_blank">https://tools.cisco.com/securi<wbr>ty/center/content/CiscoSecurit<wbr>yAdvisory/cisco-sa-20160525-<wbr>ipv6</a><br>
<br>
The Juniper knowledge base entry<br>
<br>
<a href="https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10749&cat=SIRT_1&actp=LIST" rel="noreferrer" target="_blank">https://kb.juniper.net/InfoCen<wbr>ter/index?page=content&id=<wbr>JSA10749&cat=SIRT_1&actp=LIST</a><br>
<br>
Thanks<br>
Suresh<br>
<br>
------------------------------<wbr>------------------------------<wbr>--------<br>
IETF IPv6 working group mailing list<br>
<a href="mailto:ipv6@ietf.org" target="_blank">ipv6@ietf.org</a><br>
Administrative Requests: <a href="https://www.ietf.org/mailman/listinfo/ipv6" rel="noreferrer" target="_blank">https://www.ietf.org/mailman/l<wbr>istinfo/ipv6</a><br>
------------------------------<wbr>------------------------------<wbr>--------<br>
<br>
______________________________<wbr>_________________<br>
LACTF mailing list<br>
<a href="mailto:LACTF@lacnic.net" target="_blank">LACTF@lacnic.net</a><br>
<a href="https://mail.lacnic.net/mailman/listinfo/lactf" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailma<wbr>n/listinfo/lactf</a><br>
Cancelar suscripcion: <a href="mailto:lactf-unsubscribe@lacnic.net" target="_blank">lactf-unsubscribe@lacnic.net</a><br>
<br>
</blockquote>
______________________________<wbr>_________________<br>
LACTF mailing list<br>
<a href="mailto:LACTF@lacnic.net" target="_blank">LACTF@lacnic.net</a><br>
<a href="https://mail.lacnic.net/mailman/listinfo/lactf" rel="noreferrer" target="_blank">https://mail.lacnic.net/mailma<wbr>n/listinfo/lactf</a><br>
Cancelar suscripcion: <a href="mailto:lactf-unsubscribe@lacnic.net" target="_blank">lactf-unsubscribe@lacnic.net</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><b>Ivan Chapero<br><span style="color:rgb(102,102,102)">Área Técnica y Soporte</span></b><span style="color:rgb(102,102,102)"> </span><br style="color:rgb(102,102,102)"><span style="color:rgb(102,102,102)">Fijo: 03464-470280 (interno 535)</span> | <span style="color:rgb(102,102,102)">Móvil: 03464-155-20282</span> | <span style="color:rgb(102,102,102)">Skype ID: ivanchapero</span><div><span style="color:rgb(102,102,102)">--</span><br style="color:rgb(102,102,102)"><div style="text-align:center"><span style="color:rgb(102,102,102)">GoDATA Banda Ancha - CABLETEL S.A. | Av. 9 de Julio 1163 - 2183 - Arequito - Santa Fe - Argentina</span></div><br><br><br><br><br><br><br></div></div></div>
</div></div>