RE: Cisco vulnerability scanning increase

From: Smith, Brad (brad.smith_at_saskeds.com)
Date: 09/02/05

Next message: dave kleiman: "RE: Incident legal plan??"

Previous message: nms_at_metafore.ca: "RE: Cisco vulnerability scanning increase"
Maybe in reply to: morriswurm_at_yahoo.com: "Cisco vulnerability scanning increase"
Next in thread: NotPhunny Dude: "Re: Cisco vulnerability scanning increase"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Fri, 2 Sep 2005 15:21:21 -0600
To: <morriswurm@yahoo.com>, <incidents@securityfocus.com>

Yes we are seeing it in Saskatchewan Canada as well. We checked with our ISP and they said that they were not vulnerable to this attack. It looks like the routers need to have the webserver active on them for this to work.

________________________________

From: morriswurm@yahoo.com [mailto:morriswurm@yahoo.com]
Sent: Fri 9/2/2005 10:17 AM
To: incidents@securityfocus.com
Subject: Cisco vulnerability scanning increase

We recently picked up a spike in TCP 80 scanning against one of our netblocks.

Looking at the payload, it appears to be a Cisco vulnerability scanner.

/level/16/exec/-///pwd

Numerous random source IP's across various netblocks, makes it appear to be bot related potentially. Anyone else seeing this type of activity?

Next message: dave kleiman: "RE: Incident legal plan??"

Previous message: nms_at_metafore.ca: "RE: Cisco vulnerability scanning increase"
Maybe in reply to: morriswurm_at_yahoo.com: "Cisco vulnerability scanning increase"
Next in thread: NotPhunny Dude: "Re: Cisco vulnerability scanning increase"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

Re: [fw-wiz] Variations of firewall ruleset bypass via FTP
... didn't carry through CERT- While Mikael was nice enough to code up "proof ... instead of the "produce attack code and announce the problem method.) ... but frankly all these folks (indeed also IPF) are his ... I'm willing to admit the risk assessment and the vulnerability ...
(Firewall-Wizards)
RE: how to verify whether an attack attempt is successful?
... Certainly the techniques of combining vulnerability assessment data with ... attack information is an excellent way to determine success. ... if its behind an in-line network IPS and there ... play into the accuracy and usefulness of the 'success' metrics your IDS ...
(Focus-IDS)
Re: [Full-disclosure] [WEB SECURITY] Unicode Left/Right Pointing Double Angel Quotation Mark byp
... so you are probably talking 1,000+ inputs vulnerable to attack using ... observation from one particular encounter of this vulnerability to get some ... I did some research here too, and found a new Unicode ...
(Full-Disclosure)
A(n tro^.m Email: McAfee Says Cyber-attack Details Point to IE Security Vulnerability
... McAfee Says Cyber-attack Details Point to IE Security Vulnerability ... and Google followed the attack code back to the drop servers ...
(soc.culture.vietnamese)
RUS-CERT Advisory 2001-08:01
... Vulnerabilities in several Apache authentication modules ... vulnerable to a remote SQL code injection attack. ... SQL statements or cause the database query for the password to return ... In the MySQL and Oracle cases, the impact of the vulnerability is ...
(Bugtraq)