[Full-Disclosure] Re: Addressing Cisco Security Issues

From: Geoincidents (geoincidents_at_getinfo.org)
Date: 03/30/04

  • Next message: Geoincidents: "[Full-Disclosure] Re: Addressing Cisco Security Issues" 
    To: "Clayton Kossmeyer" <ckossmey@cisco.com>, "Geo." <geoincident1@getinfo.org>
Date: Mon, 29 Mar 2004 22:21:15 -0500

    ----- Original Message -----
    From: "Clayton Kossmeyer" <ckossmey@cisco.com>

    > downloads. The reasons for this are many, but one of the major ones
    > is that SPs/ISPs want to control what versions of software are
    > deployed within their networks.

    I can certainly understand an ISP's desire to control this, however I AM THE
    ISP. I've got Alltel the DSL provider on one side and Cisco the hardware
    provider on the other side and all I wanted to do was get a secure version
    of CBOS and both Alltel and Cisco were giving me the runaround with neither
    of them accepting responsibility for maintaining the security of the device.
    So here I am the ISP trying to make sure I can secure the devices on my
    network after receiving a warning from Cisco and Cisco won't give me the
    patch. Well that makes a lot of sense.

    > Having said that, there is an exception and escalation process for
    > situations like yours.

    Yes I know, but you should also know I can't dedicate a day or two of my
    life to downloading a stupid security patch. It should not be this difficult
    to get security patches from Cisco. Cisco provides the majority of equipment
    that makes the internet function, that dominance comes with a responsibility
    to make sure people can get patches when an exploit is discovered. I don't
    care about a new version, patch the old one like MS does for all I care.
    Just put the darn patches where everyone can get at them without having to
    beg and escalate.

    > If you feel as though your case is not being addressed urgently
    > enough, you can call the TAC at any time, referencing your case
    > number, to have the priority raised or the case escalated further.

    That's fine for support issues but we are talking about security patches,
    these should not require we open any sort of ticket or have a contract or
    anything of the sort. Patches should be available to everyone free of charge
    and readily available for download.

    > I'll follow up with you unicast and we can figure out which image
    > you'll need.

    I appreciate it, but I've already downloaded the update from a non cisco
    source and applied it. I didn't need anyone at cisco to spend any time on
    me, all I needed was the patched image file.

    I don't know who calls the shots at cisco but they really should realize
    that when it's important enough to release a security bulletin, end users,
    dsl providers, isp's, none of them have a choice anymore, it's either update
    or die so what's the point of restricting access to the patched versions?

    Geo.

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Geoincidents: "[Full-Disclosure] Re: Addressing Cisco Security Issues"

    Relevant Pages