To: Terence Kennedy who wrote (11020 ) 11/3/1998 2:55:00 AM From: Terence Kennedy Respond to of 42804
I wrote : > Earlier this week, I sent them mail saying that I was going to go > to the trade press on November 1st if they didn't commit to a date > for releasing the corrected firmware. So far, I have no response. > > A different N Base employee contacted someone who is maintaining a > web page about the security bug, claiming that the web page was an > untruth. After pointing out to that employee that the problem still > exists, nothing further was heard - same old story: deny, then van- > ish. Late last week I received firmware for the NH2016 that claimed to fix the problem. Instead, it prevented all access to the switch!. I reported the problem and received the usual "we'll get back to you" response. On Monday, I ordered 6 switches from Cisco to replace the NH2016's. Just now, I received mail from one of the N Base employees I'd ex- changed mail with previously, with yet a newer version of the code. This version fixes the backdoor passwords on remote sessions, but not with the local console port. I explained that this was too little, too late. In any event, as of sometime next week when the Cisco switches come in, I won't be running any N Base switches any more and those of you who think my postings are bad for N Base will be relieved that I won't be complaining any more. Of course, the numbers of other customers who are still exposed to security bugs may complain, since I doubt N Base will notify customers or put a notice on their download pages. I'll be returning the NH2016 switches to N Base (we had suspended payment pending fixes for this and other bugs). However, I still have 5 NH208, 4 NH215, and assorted NX200 modules which I'd already paid for and which N Base will not credit me for. If anyone reading this board actually uses the equipment (whatever happened to Jack Colton?) I will sell this gear at fire sale prices. Just send me a message at terry@spcvxa.spc.edu.