I wrote :
> Earlier this week, I sent them mail saying that I was going to go
> to the trade press on November 1st if they didn't commit to a date
> for releasing the corrected firmware. So far, I have no response.
>
> A different N Base employee contacted someone who is maintaining a
> web page about the security bug, claiming that the web page was an
> untruth. After pointing out to that employee that the problem still
> exists, nothing further was heard - same old story: deny, then van-
> ish.
Late last week I received firmware for the NH2016 that claimed to
fix the problem. Instead, it prevented all access to the switch!. I
reported the problem and received the usual "we'll get back to you"
response.
On Monday, I ordered 6 switches from Cisco to replace the NH2016's.
Just now, I received mail from one of the N Base employees I'd ex-
changed mail with previously, with yet a newer version of the code.
This version fixes the backdoor passwords on remote sessions, but not
with the local console port. I explained that this was too little, too late.
In any event, as of sometime next week when the Cisco switches come
in, I won't be running any N Base switches any more and those of you
who think my postings are bad for N Base will be relieved that I won't
be complaining any more.
Of course, the numbers of other customers who are still exposed to
security bugs may complain, since I doubt N Base will notify customers
or put a notice on their download pages.
I'll be returning the NH2016 switches to N Base (we had suspended
payment pending fixes for this and other bugs). However, I still have
5 NH208, 4 NH215, and assorted NX200 modules which I'd already paid
for and which N Base will not credit me for. If anyone reading this
board actually uses the equipment (whatever happened to Jack Colton?)
I will sell this gear at fire sale prices. Just send me a message at
terry@spcvxa.spc.edu. |
