When running security scans against a 5224 (at firmware version v.3.1.0.8) enabling safe checks only, the Admin interfaces cannot be accessed (Web, Telnet, SNMP, or even a ping to the switch IP). All other switch functions seem normal, a switch reload corrects the problem. This has been observed in the 3248 and the 5224.
I am trying to isolate the test that caused the problem and once isolated and repeatable I will try the new firmware version (although this has been reported on the new firmware version). Has anyone heard of this occurring? The 3Com managed switches are not affected by this scan.
Has anybody got a fix for this problem. How can we resolve this issue. I have observed similar behavior on the 5212, 5224, and 3248 - (firmware 3.1.0.8).
The only difference is we used a Qualys Scanner instead of a Nessus Scanner.
I have a ticket open with Dell networking but still no news. I also tried the latest firmware upgrade, problem still exists... Does Dell monitor these boards, it is very strange we haven't heard any thing from them.... If I find out anything I'll keep you posted.
I haven't heard a thing from Dell, since I spoke with a Dell Engineer abour it. I imagine this is well down on their 'fix' list because it doesn't affect the operation of the switch per se, only the Admin interface. We have been careful to exclude the Dell Switches from security scans because they are so 'delicate', I know its not the right answer but until it is resolved that's about all I can add.
JeffD123
4 Posts
437
0
Posted May 17th, 2004 21:00
Update:
Completed isolating the vulnerability test that was causing the issue:
Name: Find if IIS server allows BASIC and/or NTLM authentication
Nessus ID: 11871
This is repeatable every time on firmware builds v.3.1.0.8 and v.3.1.0.13 on a 5224.