"Karl Krukow" skrev
> Jeg synes at have læst et sted at det ikke er nok at disable webinter-
> face'et. Jeg mener at der stod at Cisco'en stadig lyttede på port 80
> og dermed var sårbar - er der nogen der kan be- eller af-kræfte dette?
Fra Cisco:
<URL:
http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub.shtml >
"To avoid unnecessary handling of HTTP requests by Cisco routers running
IOS, disable the HTTP server by applying
no ip http server
while in global configuration mode. If HTTP service is needed, consider
restricting access by applying an access list command."
Og:
<URL:
http://www.cisco.com/warp/public/707/CBOS-multiple.shtml >
"Workarounds
CSCdr98772
There are two workarounds for this vulnerability. The potential for
exploitation can be lessened by ensuring that Web access to the router
is limited to a legitimate IP address.
This can be done by entering the following commands while in enable
mode:
cbos# set web remote 10.0.0.1
cbos# set web remote enabled
where 10.0.0.1 is the address of the host with a legitimate need for Web
access to the router.
Alternatively, disabling the Web access completely will also prevent
this vulnerability from being exploited. This can be done by entering
the following command while in enable mode:
cbos# set web remote disable
CSCds59206
There is no workaround for this vulnerability.
CSCds19142
The Web Management interface can be disabled by entering the following
commands in enable mode:
cbos# set web remote disable
CSCds23921
All incoming ICMP ECHO (PING) packets destined to the router itself
should be denied. That can be achieved by following commands:
cbos# set filter number on deny incoming all 0.0.0.0 0.0.0.0 <eth0_IP_address> 255.255.255.255 protocol ICMP
cbos# set filter number+1 on deny incoming all 0.0.0.0 0.0.0.0 <wan0_IP_address> 255.255.255.255 protocol ICMP
Where number is a free filter number between 0 and 17."