[c-nsp] OSPF4-BAD-LENGTH

Thu Jul 3 14:33:55 EDT 2008

Sounds possibly like an attack versus CSCsf12082. CVE is CVE-2008-0537

http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml
--
robbie

             Eric Van Tol                                                  
             <eric at atlantech.n                                             
             et>                                                        To 
             Sent by:                  "cisco-nsp at puck.nether.net"         
             cisco-nsp-bounces         <cisco-nsp at puck.nether.net>         
             @puck.nether.net                                           cc 

                                                                   Subject 
             07/03/2008 06:45          [c-nsp] OSPF4-BAD-LENGTH            
             AM                                                            

Hi all,
This isn't a question of what, but how :-)  We received this log on one of
our 6509s last night:

Jul  3 06:04:40 EDT: %OSPF-4-BADLENGTH: Invalid length 34778 in OSPF packet
type 39 from 218.106.119.133 (ID 244.193.1.14), GigabitEthernet1/5

This address has no direct connectivity with our network, as it appears to
be from a Chinese network.  My question is how does an OSPF packet get
through the general internet?  Or could this be more than likely just some
sort of vulnerability scanner that is spoofing various protocols?

-evt
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/