-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                  ESB-2002.067 -- Cisco Security Advisory
              Malformed SNMP Message-Handling Vulnerabilities
                             13 February 2002

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                Multiple Cisco products implementing the 
                        Simple Network Management Protocol (SNMP)
Vendor:                 Cisco Systems
Impact:                 Denial of Service
Access Required:        Remote

Ref:                    AL-2002.02
                        ESB-2002.065
                        ESB-2002.066

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

Cisco Security Advisory: Malformed SNMP Message-Handling Vulnerabilities

Revision 1.0

For Public Release 2002 February 12 20:00 GMT

- - -------------------------------------------------------------------------------

Summary
=======
Multiple Cisco products contain vulnerabilities in the processing of Simple
Network Management Protocol (SNMP) messages. The vulnerabilities can be
repeatedly exploited to produce a denial of service. In most cases, workarounds
are available that may mitigate the impact. These vulnerabilities are
identified by various groups as VU#617947, VU#107186, OUSPG #0100,
CAN-2002-0012, and CAN-2002-0013.

This advisory is available at http://www.cisco.com/warp/public/707/
cisco-malformed-snmp-msgs-pub.shtml.

Affected Products
=================
This security advisory applies to a broad range of Cisco products. To determine
if a product is vulnerable, review the list below. If software versions or
configuration information is included, then only those combinations are
affected (or unaffected). If the product or series is listed without any
qualifying software version information, then consult the Software Versions and
Fixes section to determine if the product is running an affected version of
software. Additional information per product is provided in the Details and
Workarounds sections below.

The following Cisco products are vulnerable if they are running an affected
version of software:

  * 800, 1000, 1005, 1400, 1600, 1700, 2500, 2600, 3600, MC3810, 4000, 4500,
    4700, 6200, 6400 NRP, 6400 NSP series Cisco routers
  * ubr900 and ubr920 universal broadband routers
  * Catalyst 1500, 290x, 292x, 2900XL, 2948g, 2948g-l3, 2950, 3000, 3200,
    3500XL, 3550, 4000, 4232, 4232-l3, 4840g, 4908g-l3, 4912g, 5000, 6000 RSFC
    series switches
  * AS5200, AS5300, AS5800 series access servers
  * Catalyst 6000 MSM, 6000 Hybrid Mode, 6000 Native Mode, 6000 Supervisor
    Module, Catalyst ATM Blade, Catalyst 6000 Network Analysis Module (NAM)
  * RSM, 7000, 7010, 7100, 7200, ubr7200, 7500, 7600 OSR, 10000 ESR, and 12000
    GSR series Cisco routers
  * Lightstream 1010 ATM switches
  * DistributedDirector
  * Catalyst 8510CSR, 8510MSR, 8540CSR, 8540MSR series switches.
  * BPX, IGX, MGX WAN switches, and the Service Expansion Shelf
  * WAN Manager
  * Cisco Secure PIX firewall
  * Cisco Secure Intrusion Detection System (NetRanger) appliance and IDS
    Module
  * BR340, WGB340, AP340, AP350, BR350 Cisco/Aironet wireless products
  * CSS11000 (Arrowpoint) Content Services Switch
  * Cache Engine 505 and 570 running 2.3 or 2.5
  * Content Engine 507, 560 and 590 running 2.3 or 2.5
  * Content Engine 507, 560, 590, and 7320 running 3.1, 4.0, or 4.1
  * LocalDirector
  * Internet CDN
  * VPN3000 (Altiga) VPN Concentrator
  * VPN5000 VPN Concentrator
  * Access Registrar running on Solaris 8
  * Cisco ws-x6608 and ws-x6624 IP Telephony Modules
  * Traffic Director
  * Cisco Info Center
  * Switch Probe
  * CiscoWorks Windows
  * Hosting Solution Engine
  * User Registration Tool VLAN Policy Server
  * Cisco Element Management Framework

Products Not Affected
=====================
The following Cisco products are not affected by this vulnerability in the
specified configuration, either because they do not contain the associated
defect or because they do not support SNMP. If software version information is
provided, then only that specific combination of product and software version
is not vulnerable.

  * Catalyst 1900s switch running any version of CatOS
  * FastHub 300 Ethernet repeater
  * Cache Engine 505 and 570 running version 2.3 or 2.5.x
  * Cache Engine and Content Delivery Manager running CDM Enterprise 3.0.x
  * CR-4430B running CDM Enterprise 3.0.x
  * IP/TV
  * Device Fault Manager
  * ME1100 series
  * Voice Manager
  * RTM
  * IP Phone (all models)
  * SN5400 series storage routers
  * CallManager
  * Unity Server
  * Access Registrar running on Solaris 7.5.1

No other Cisco product is known to be affected by this vulnerability.

Details
=======
Simple Network Management Protocol (SNMP) defines a standard mechanism for
remote management and monitoring of devices in an Internet Protocol (IP)
network.

There are three types of SNMP messages: "get" requests to request information,
"set" requests which modify the configuration of the remote device, and "trap"
messages which provide a monitoring function.

An Object Identifier (OID) is the label employed by SNMP to uniquely specify an
item to be managed. OIDs in human-readable format are displayed as long strings
of decimal integers separated by periods, but they are packed into a more
efficient binary form for use within SNMP.

The largest group of vulnerabilities described in this advisory result from
insufficient checking of SNMP messages as they are received and processed by an
affected system. Malformed SNMP messages received by affected systems can cause
various parsing and processing functions to fail, resulting in a system crash
and a reload in most circumstances. Under some conditions, the affected device
can not reload. In a specific combination with an unrelated software defect,
the device reloads continuously and requires manual intervention to resume
normal operation.

These vulnerabilities can be easily and repeatedly demonstrated with the use of
the University of Oulu Secure Programming Group (OUSPG) "PROTOS" Test Suite for
SNMP. The test suite is generally used to analyze a protocol and produce
messages that probe various design limits within an implementation of a
protocol. Examples such as overly-long OIDs, malformed OIDs, and other
combinations of values appropriate to SNMP can be programmatically generated
and then transmitted to a network device under test. The test suite for SNMP,
as distributed, contains approximately 53,000 individual test cases. The
authors intend to make the SNMP test suite available to the public at the same
time that this advisory is published.

Impact
======
The vulnerability can be exploited to produce a Denial of Service (DoS) attack.
When the vulnerability is exploited, it can cause an affected Cisco product to
crash and reload.

SNMP messages are transported using User Datagram Protocol (UDP) and are
subject to IP source address spoofing. In any circumstance where ingress and
egress source IP address filtering is lacking, it is more likely that an
attacker could spoof the source IP address and circumvent access control
mechanisms to cause a vulnerable system to fail.

If an attacker is able to guess or otherwise obtain a read-only community
string for an affected device, then he or she could bypass SNMP access control
relying on the community string.

Software Versions and Fixes
===========================
Cisco IOS Software

Each row of the Cisco IOS software table (below) describes a release train and
the platforms or products for which it is intended. If a given release train is
vulnerable, then the earliest possible releases that contain the fix (the
"First Fixed Release") and the anticipated date of availability for each are
listed in the "Rebuild," "Interim," and "Maintenance" columns. A device running
a release in the given train that is earlier than the release in a specific
column (less than the First Fixed Release) is known to be vulnerable. The
release should be upgraded at least to the indicated release or a later version
(greater than or equal to the First Fixed Release label). When selecting a
release, keep in mind the following definitions:

    Maintenance
        Most heavily tested, stable, and highly recommended release of a
        release train in any given row of the table.
       
    Rebuild
        Constructed from the previous maintenance or major release in the same
        train, it contains the fix for a specific defect. Although it receives
        less testing, it contains only the minimal changes necessary to repair
        the vulnerability.
       
    Interim
        Built at regular intervals between maintenance releases and receives
        less testing. Interims should be selected only if there is no other
        suitable release that addresses the vulnerability. Interim images
        should be upgraded to the next available maintenance release as soon as
        possible. Interim releases are not available through manufacturing, and
        usually they are not available for customer download from CCO without
        prior arrangement with the Cisco TAC.
       
In all cases, customers should exercise caution to confirm that the devices to
be upgraded contain sufficient memory and that current hardware and software
configurations will continue to be supported properly by the new software
release. If the information is not clear, contact the Cisco TAC for assistance
as shown in the "Obtaining Fixed Software" section.

More information on Cisco IOS software release names and abbreviations is
available at http://www.cisco.com/warp/public/620/1.html.

+---------------------------------------------------------------------------+
|                         |     Image     |                                 |
|          Train          |  Description  | Availability of Fixed Releases* |
|                         |  or Platform  |                                 |
|-----------------------------------------+---------------------------------|
|              11.x Releases              | Rebuild | Interim | Maintenance |
|                                         |         |   **    |             |
|-----------------------------------------+---------+---------+-------------|
|                         |               | 11.0    |         |             |
|                         |               | (22b)   |         |             |
|11.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 11.1    |         |             |
| 11.1                    |               | (24b)   |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 11.1    |         |             |
|                         |               | (20)AA4 |         |             |
|11.1AA                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 11.1    |         |             |
|                         |               | (36)CA2 |         |             |
|11.1CA                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 11.1    |         |             |
|                         |               | (36)CC4 |         |             |
|11.1CC                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 11.1    |         |             |
| 11.1CT                  |               | (28a)CT |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 11.1    |         |             |
| 11.1IA                  |               | (28a)IA |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 11.2    |         |             |
|                         |               | (26b)   |         |             |
|11.2                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 11.2    |         |             |
|                         |               | (23a)   |         |             |
| 11.2BC                  |               | BC1     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 11.2    |         |             |
|                         |               | (19a)   |         |             |
| 11.2GS                  |               | GS6     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 11.2    |         |             |
|                         |               | (26)P1  |         |             |
|11.2P                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 11.2    |         |             |
|                         |               | (8.9)   |         |             |
| 11.2SA                  |               | SA6     |         |             |
|                         |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 11.3    |         |             |
|                         |               | (11c)   |         |             |
|11.3                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 11.3(7) |         |             |
| 11.3DB                  |               | DB1     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 11.3(8) |         |             |
| 11.3DB                  |               | DB2     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 11.3    |         |             |
|                         |               | (11b)T2 |         |             |
|11.3T                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (21a)   |         |             |
|12.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (8a)    |         |             |
|12.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (9a)    |         |             |
|12.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (10a)   |         |             |
|12.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (11a)   |         |             |
|12.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (12a)   |         |             |
|12.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (13a)   |         |             |
|12.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (14a)   |         |             |
|12.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (15a)   |         |             |
|12.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (16a)   |         |             |
|12.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (17a)   |         |             |
|12.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (2b)    |         |             |
|12.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (3d)    |         |             |
|12.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (5a)    |         |             |
|12.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (6a)    |         |             |
|12.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (19a)   |         |             |
|12.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (20a)   |         |             |
|12.0                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
| 12.0                    |               | (18b)   |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (13)WT6 |         |             |
| 12.0WT                  |               | (1)     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(2) |         |             |
| 12.0(2)XE               |               | XE?     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(2) |         |             |
| 12.0(2)XF               |               | XF?     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
| 12.0(20)SX              |               | (21)SX  |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(4) |         |             |
|                         |               | XE1     |         |             |
|12.0(4)XE                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(4) |         |             |
|                         |               | XM1     |         |             |
|12.0(4)XM                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(5) |         |             |
|                         |               | WC2b    |         |             |
|12.0(5)WC 2900XL-LRE     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(5) |         |             |
|                         |               | XE3     |         |             |
|12.0(5)XE                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(5) |         |             |
|                         |               | XK2     |         |             |
|12.0(5)XK                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(5) |         |             |
| 12.0(5)XN               |               | XN1     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(5) |         |             |
| 12.0(5)XP, 2900XL,      |               | WC3     |         |             |
|3500XL platform          |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(5) |         |             |
| 12.0(5)XS               |               | XS2     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(5) |         |             |
| 12.0(5)XU 2900XL,       |               | WC3     |         |             |
|3500XL platform          |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(7) |         |             |
|                         |               | XE1     |         |             |
|12.0(7)XE                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(7) |         |             |
| 12.0(7)XF               |               | XF1     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(7) |         |             |
|                         |               | XK3     |         |             |
|12.0(7)XK                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(7) |         |             |
| 12.0(7)XV               |               | XV      |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(7) |         |             |
| 12.0DB                  |               | DB2     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(7) |         |             |
| 12.0DC                  |               | DC1     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (16)S8  |         |             |
|12.0S                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (21)S1  |         |             |
|12.0S                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (13)S6  |         |             |
|12.0S                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(9) |         |             |
|                         |               | S8      |         |             |
|12.0S                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (17)S4  |         |             |
|12.0S                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (15)S6  |         |             |
|12.0S                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (18)S5  |         |             |
|12.0S                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (19)S2  |         |             |
|12.0S                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (12)S3  |         |             |
|12.0S                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (14)S7  |         |             |
|12.0S                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (10)S7  |         |             |
|12.0S                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (11)S6  |         |             |
|12.0S                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(8) |         |             |
|                         |               | S1      |         |             |
|12.0S                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (16)SC3 |         |             |
|12.0SC                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (17)SL6 |         |             |
|12.0SL                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (19)SL4 |         |             |
|12.0SL                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (20)SP1 |         |             |
|12.0SP                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (17)ST5 |         |             |
|12.0ST                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (19)ST2 |         |             |
|12.0ST                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (11)ST4 |         |             |
|12.0ST                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (14)ST3 |         |             |
|12.0ST                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (16)ST1 |         |             |
|12.0ST                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (18)ST1 |         |             |
|12.0ST                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (20)ST2 |         |             |
|12.0ST                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
| 12.0ST                  |               | (21)ST  |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(7) |         |             |
|                         |               | T2      |         |             |
|12.0T                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         |               | (18)W5  |         |             |
| 12.0W5                  | cat2948g-L3,  | (22b)   |         |             |
|                         |cat4232        |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0    |         |             |
|                         | c5atm,cat8510 | (20)W5  |         |             |
| 12.0W5                  | [c,m]         | (24a)   |         |             |
|                         |cat8540[c,m],  |---------|         |             |
|                         | ls1010        | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (3b)    |         |             |
|12.1                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (4a)    |         |             |
|12.1                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (13)    |         |             |
|12.1                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (8c)    |         |             |
|12.1                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (1c)    |         |             |
|12.1                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (2b)    |         |             |
|12.1                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (5e)    |         |             |
|12.1                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (6a)    |         |             |
|12.1                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (7b)    |         |             |
|12.1                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (9a)    |         |             |
|12.1                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (12b)   |         |             |
|12.1                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (11b)   |         |             |
|12.1                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (10a)   |         |             |
|12.1                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
| 12.1(10)EX              |               | (10)EX  |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
| 12.1(10)EY              |               | (10)EY  |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(2) |         |             |
|                         |               | XF5     |         |             |
|12.1(2)XF                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(3) |         |             |
|                         |               | XG6     |         |             |
|12.1(3)XG                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (3a)XI8 |         |             |
|12.1(3)XI                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(3) |         |             |
| 12.1(3)XP               |               | XP      |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(3) |         |             |
| 12.1(3)XQ               |               | XQ      |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(3) |         |             |
| 12.1(3)XT               |               | XT3     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(4) |         |             |
|                         |               | XY8     |         |             |
|12.1(4)XY                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(4) |         |             |
|                         |               | XZ7     |         |             |
|12.1(4)XZ                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(5) |         |             |
|                         |               | XM7     |         |             |
|12.1(5)XM                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(5) |         |             |
|                         |               | XV5     |         |             |
|12.1(5)XV                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(5) |         |             |
|                         |               | XV4     |         |             |
|12.1(5)XV                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(5) |         |             |
|                         |               | XV5     |         |             |
|12.1(5)XV                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(5) |         |             |
|                         |               | YA2     |         |             |
|12.1(5)YA                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(5) |         |             |
|                         |               | YB5     |         |             |
|12.1(5)YB                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(5) |         |             |
|                         |               | YC2     |         |             |
|12.1(5)YC                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(5) |         |             |
|                         |               | YD6     |         |             |
|12.1(5)YD                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(5) |         |             |
|                         |               | YF4     |         |             |
|12.1(5)YF                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(5) |         |             |
|                         |               | YH3     |         |             |
|12.1(5)YH                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(5) |         |             |
|                         |               | YI1     |         |             |
|12.1(5)YI & 12.1(5)EY    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(6) |         |             |
|                         |               | EZ6     |         |             |
|12.1(6)EZ                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (7a)EY3 |         |             |
|12.1(7a)EY               |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (8a)EW1 |         |             |
|12.1(8a)EW               |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (8b)EX4 |         |             |
|12.1(8a)EX               |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(9) |         |             |
|                         |               | EX3     |         |             |
|12.1(9)EX                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(8) |         |             |
|                         |               | AA1     |         |             |
|12.1AA                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
| 12.1AA                  |               | (10)AA  |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(7) |         |             |
| 12.1DA                  |               | DA3     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(5) |         |             |
|                         |               | DB1     |         |             |
|12.1DB                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(1) |         |             |
| 12.1DB                  |               | DB2     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(3) |         |             |
| 12.1DB                  |               | DB1     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(4) |         |             |
| 12.1DB                  |               | DB2     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(5) |         |             |
|                         |               | DC2     |         |             |
|12.1DC                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(1) |         |             |
| 12.1DC                  |               | DC2     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(3) |         |             |
| 12.1DC                  |               | DC2     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(4) |         |             |
| 12.1DC                  |               | DC2     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(9) |         |             |
|                         |               | E2      |         |             |
|12.1E                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(9) |         |             |
|                         |               | E3      |         |             |
|12.1E                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (10)E4  |         |             |
|12.1E                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(1) |         |             |
|                         |               | E5      |         |             |
|12.1E                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (5c)E12 |         |             |
|12.1E                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (5c)E12 |         |             |
|12.1E                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (8b)E11 |         |             |
|12.1E                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (11)E   |         |             |
|12.1E                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /25     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (8b)E9  |         |             |
|12.1E                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(6) |         |             |
| 12.1E                   |               | E8      |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
| 12.1E                   |               | (3a)E7  |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
| 12.1E                   |               | (3a)E8  |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
| 12.1E                   |               | (7a)E6  |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(4) |         |             |
|                         |               | E3      |         |             |
|12.1E                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
|                         |               | (10)EC1 |         |             |
|12.1EC                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1    |         |             |
| 12.1EC                  |               | (11)EC  |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(5) |         |             |
|                         |               | T12     |         |             |
|12.1T                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2    |         |             |
|                         |               | (1d)    |         |             |
|12.2                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2    |         |             |
|                         |               | (5d)    |         |             |
|12.2                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2    |         |             |
|                         |               | (6c)    |         |             |
|12.2                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2    |         |             |
|                         |               | (3d)    |         |             |
|12.2                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2    |         |             |
|                         |               | (7a)    |         |             |
|12.2                     |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
|                         |               | XA5     |         |             |
|12.2(1)XA                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(1) |         |             |
|                         |               | XD3     |         |             |
|12.2(1)XD                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(1) |         |             |
|                         |               | XE2     |         |             |
|12.2(1)XE                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(1) |         |             |
| 12.2(1)XS               |               | XS1     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
|                         |               | BY2     |         |             |
|12.2(2)BY                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
|                         |               | XB3     |         |             |
|12.2(2)XB                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
|                         |               | XB4     |         |             |
|12.2(2)XB                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
| 12.2(2)XG               |               | XG1     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
|                         |               | XH2     |         |             |
|12.2(2)XH                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
|                         |               | XI1     |         |             |
|12.2(2)XI                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
| 12.2(2)XJ               |               | XJ1     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
|                         |               | XK2     |         |             |
|12.2(2)XK                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
| 12.2(2)XN               |               | XN      |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
|                         |               | XT3     |         |             |
|12.2(2)XT                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
|                         |               | XU2     |         |             |
|12.2(2)XU                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
|                         |               | XU1     |         |             |
|12.2(2)XU                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
|                         |               | XU2     |         |             |
|12.2(2)XU                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
| 12.2(2)YC               |               | YC      |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(4) |         |             |
|                         |               | XL4     |         |             |
|12.2(4)XL                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(4) |         |             |
|                         |               | XM2     |         |             |
|12.2(4)XM                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(4) |         |             |
|                         |               | XV5     |         |             |
|12.2(4)XV                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(4) |         |             |
| 12.2(4)XW               |               | XW1     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(4) |         |             |
|                         |               | YA1     |         |             |
|12.2(4)YA                |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(4) |         |             |
| 12.2(4)YB               |               | YB      |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(4) |         |             |
| 12.2B                   |               | BX      |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(4) |         |             |
|                         |               | B2      |         |             |
|12.2B                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(4) |         |             |
|                         |               | B4      |         |             |
|12.2B                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(4) |         |             |
|                         |               | BC1a    |         |             |
|12.2BC                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
|                         |               | BX      |         |             |
|12.2BX                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(4) |         |             |
| 12.2BX                  |               | BX      |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(7) |         |             |
|                         |               | DA      |         |             |
|12.2DA                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2    |         |             |
| 12.2DA                  |               | (1b)DA1 |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(5) |         |             |
| 12.2DA                  |               | CA1     |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
|                         |               | DD3     |         |             |
|12.2DD                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(4) |         |             |
|                         |               | MB3     |         |             |
|12.2MB                   |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(9) |         |             |
| 12.2S                   |               | S       |         |             |
|                         |               |---------|         |             |
|                         |               | TBD     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(2) |         |             |
|                         |               | T4      |         |             |
|12.2T                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(4) |         |             |
|                         |               | T3      |         |             |
|12.2T                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /19     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2    |         |             |
|                         |               | (6.8)   |         |             |
| 12.2T                   |               | T0a     |         |             |
|                         |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /15     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2(8) |         |             |
|                         |               | T       |         |             |
|12.2T                    |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.2    |         |             |
|                         |               | (6.8)   |         |             |
| 12.2T                   |               | T1a     |         |             |
|                         |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
| 2900XL/3500XL 12.0(5.1) |               | 12.0(5) |         |             |
| XP 12.0(5)XU 12.0(5.2)  |               | WC3     |         |             |
|XU 12.0(5.3)WC1 12.0(5)  |               |---------|         |             |
| WC2                     |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.0(5) |         |             |
| 2900XL-LRE: 12.0(5)WC2, |               | WC2b    |         |             |
|12.0(5.4)WC1             |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(6) |         |             |
| 2950 12.0(5.3)WC1 12.0  |               | EA2b    |         |             |
|(5.4)WC1 12.0(5)WC2      |               |---------|         |             |
| 12.1(6)EA2 12.1(6)EA2a  |               | 2002/02 |         |             |
|                         |               | /11     |         |             |
|-------------------------+---------------+---------+---------+-------------|
|                         |               | 12.1(8) |         |             |
| 3550 12.1(4)EA1e 12.1   |               | EA1b    |         |             |
|(6)EA1 12.1(6)EA1a       |               |---------|         |             |
|                         |               | 2002/02 |         |             |
|                         |               | /12     |         |             |
+---------------------------------------------------------------------------+

Please review the information in the following link for details on Cisco
non-IOS products:

http://www.cisco.com/warp/public/707/
cisco-malformed-snmp-msgs-non-ios-pub.shtml

Obtaining Fixed Software
========================
Cisco is offering free software upgrades to remedy this vulnerability for all
affected customers. Customers with service contracts may upgrade to any
software release containing the feature sets they have purchased. Customers
without contracts may upgrade only within a single row of the table above,
except that any available fixed software release will be provided to any
customer who can use it and for whom the standard fixed software release is not
yet available. Customers may only install and expect support for the feature
sets they have purchased.

Customers with contracts should obtain upgraded software through their regular
update channels. For most customers, this means that upgrades should be
obtained through the Software Center on Cisco's Worldwide Web site at http://
www.cisco.com/.

Customers whose Cisco products are provided or maintained through prior or
existing agreement with third-party support organizations such as Cisco
Partners, authorized resellers, or service providers should contact that
support organization for assistance with the upgrade, which should be free of
charge.

Customers who purchased directly from Cisco but who do not hold a Cisco service
contract, and customers who purchase through third party vendors but are
unsuccessful at obtaining fixed software through their point of sale, should
obtain fixed software by contacting the Cisco Technical Assistance Center
(TAC). TAC contacts are as follows:

  * +1 800 553 2447 (toll free from within North America)
  * +1 408 526 7209 (toll call from anywhere in the world)
  * e-mail: tac@cisco.com

See http://www.cisco.com/warp/public/687/Directory.shtml for additional TAC
contact information, including instructions and e-mail addresses for use in
various languages.

Please have your product serial number available and give the URL of this
notice as evidence of your entitlement to a free upgrade. Free upgrades for
non-contract customers must be requested through the TAC.

Please do not contact either "psirt@cisco.com" or "security-alert@cisco.com"
for software upgrades.

Workarounds
===========
The usefulness of any workaround is dependent on specific customer situations
such as products, software versions, network topology, traffic behavior, and
organizational mission. Due to the great variety of affected products and
releases, customers should carefully evaluate each workaround to ensure it is
appropriate for use in the intended network before it is deployed.

General Measures

  * Turn SNMP off in the device. This is an effective workaround, but removes
    management capability to the device. This can be done using the following 
    configure command:
   
       
        no snmp-server
       
    Removing the community string public with the configure command:
   
       
        no snmp-server community public ro
       
    is not sufficient as the SNMP server will still be running and the device
    will be vulnerable. The command no snmp server must be used instead. Verify
    SNMP server status by using the enable command show snmp. You should see a
    response of "%SNMP agent not enabled".
   
  * Apply an extended access list (ACL) to deny protocol UDP, port 161 and 162,
    at the interface level such that SNMP access to the device is allowed only
    from the network management workstations. This can be done using the
    following configure commands:
   
       
        access-list 100 permit ip host 1.1.1.1 any
        access-list 100 deny udp any any eq snmp
        access-list 100 deny udp any any eq snmptrap
        access-list 100 permit any any
       
    where 1.1.1.1 is the trusted network management station. This access list
    must be applied to all interfaces using the following configure commands:
   
        interface serial 0
        ip access-group 100 in
       
    This will not prevent spoofed IP packets with the source IP address set to
    that of the network management station from reaching the switch's
    management interface.
   
    The access-list statement containing "snmptrap" will prevent notification
    messages from entering the network when it is applied at the network edge.
   
    The Cisco SAFE white papers cover techniques that can be used to control IP
    address spoofing. These papers can be found at:
   
    Cisco SAFE Solution
   
    Two white papers cover securing your network in general and controlling IP
    address spoofing specifically:
   
    SAFE: A Security Blueprint for Enterprise Networks
    SAFE: Extending the Security Blueprint to Small, Midsize, and Remote-User
    Networks

Workarounds with Caveats

  * Apply an SNMP community-based ACL to allow SNMP access to the device only
    from the network management workstations using the following configure
    commands:
   
       
        access-list 1 permit 1.1.1.1
        snmp-server community string1 ro 1
       
    In this case the trusted management station is at address 1.1.1.1.
   
    If community strings are also configured for notifications, they must be
    different than the community strings used for requests in order for this
    workaround to be effective. Use the following configure commands to change
    community strings for notifications that are the same as community strings
    used for requests.
   
        no snmp-server host 1.1.1.1 string1
        snmp-server community string1 ro 1
       
    The second command above reapplies the access list to the community and
    must be reentered after the snmp-server host command is entered to ensure
    the access list is applied correctly in some Cisco IOS software releases.
   
    Use the following configure command to tell the device to send
    notifications using the new community string:
   
        snmp-server host 1.1.1.1 anythingbutstring1
       
    All community strings used for notifications, like the "anythingbutstring1"
    community string above, need to be set to deny all SNMP requests. Use the
    following configure commands to do this:
   
        access-list 2 deny any
        snmp-server community anythingbutstring1 ro 2
       
    This is required because Cisco IOS software configures community strings
    used for notifications with no read or write view. You cannot see or change
    any information on the device using this string. However, requests using a
    community string with no view will still be processed by the device and the
    PROTOS tool could exploit this processing and crash the device.
   
    Please note that in order for this to take effect, the commands must be
    issued in the following order:
   
        snmp-server host 1.1.1.1 anythingbutstring1
        snmp-server community anythingbutstring1 ro 2
       
    This configuration will not survive a reload.
   
    In certain releases, entering the snmp-server community command will delete
    the notify view required to send traps. This can be determined by running
    the enable command:
   
        show snmp group
       
    Look for two or more groups with the same name as the community string used
    for notifications. The output should look like this:
   
        groupname: anythingbutstring1           security model:v1 
        readview :v1default                     writeview:  
        notifyview: *tv.FFFFFFFF.FFFFFFFF    
        row status: active      access-list: 1
    
        groupname: anythingbutstring1           security model:v2c 
        readview :v1default                     writeview:  
        notifyview: 
        row status: active      access-list: 1
   
    Ensure that the notifyview is set for the version of notifications you want
    the device to send and that the access-list is set correctly for all
    security models.
   
    If either fields are not correct, first reapply the configure command:
   
       
        snmp-server host 1.1.1.1 anythingbutstring1
       
    Then look at the output of show snmp group again. Take the view listed as
    the notifyview, the correct access-list number, and the security model
    version and enter the following configure command:
   
        snmp-server group anythingbutstring1 v1 notify *tv.FFFFFFFF.FFFFFFFF
        access 1
       
    Modify the above command to match your configuration. Verify this worked
    using the show snmp group enable command.
   
    Note: The snmp-server group command will show up in the configuration
    before the snmp-server host command, so this part of the workaround will
    not survive a reboot. After a reboot, the device will continue to send
    traps but the snmp-server group command will need to be reentered to
    protect the device from exploits using this community string.
   
  * Do not use the string "public" as a community string at all. The PROTOS
    test suite uses "public" in its tests as configured by OULU.
   
    Note: Even though the current version of the PROTOS tests will not crash
    the Cisco IOS software device if the device community string is not public,
    it is very easy to modify the PROTOS code so that other community string
    values are used. Therefore, it is important to use a community ACL to
    further reduce your risk.
   
Caveats

The following workaround is effective in the following Cisco IOS software
releases:

    11.0, 11.1, 11.2 and derivatives
    12.0(3)T and later 12.0()T
    12.0(6)S and later 12.0S
    12.0(8.6)ST through 12.0(19.1)ST, 12.0(19.6)ST and later
    12.1
    12.1(1)T up to 12.1(4.4)T
    12.1(1)E up to 12.1(9.4)E
    12.1(1)EC up to 12.1(9.4)EC
   
to the best of our knowledge at this time based on testing and code inspection.

These workarounds are NOT effective in:

    11.3, 11.3T
    12.0
    12.0(1)S through 12.0(5.x)S
    12.0(19.3)ST, 12.0(19.3)ST1, 12.0(19.3)ST2
    12.1(4.4)T2 and later 12.1()T
    12.1(9.5)E and later 12.1()E
    12.1(9.5)EC and later 12.1()EC
    12.2, 12.2T
   
Troubleshooting Tips for Cisco IOS Software

  * Configure the startup-config with no SNMP and the running-config with the
    SNMP. In the event of a successful exploit due to this vulnerability, the
    affected device will reload with a new configuration in which SNMP is
    disabled. This will prevent additional, repeated exploit of the
    vulnerability.
   
  * Configure the SNMP Community ACLs with the "log" keyword. Monitor syslog
    for failed attempts.
   
  * Periodically check SNMP for errors.
   
    Configuration Notes
   
    show snmp
   
    Command output:
   
    router#show snmp
    Chassis: 21350479
    17005 SNMP packets input
        37 Bad SNMP version errors  ** 
        15420 Unknown community name  ** 
        0 Illegal operation for community name supplied
        1548 Encoding errors   ** 
        0 Number of requested variables
        0 Number of altered variables
        0 Get-request PDUs
        0 Get-next PDUs
        0 Set-request PDUs
    0 SNMP packets output
        0 Too big errors (Maximum packet size 1500)
        0 No such name errors
        0 Bad values errors
        0 General errors
        0 Response PDUs
        0 Trap PDUs
    Watch the counters marked **

Exploitation and Public Announcements
=====================================
Cisco is not aware of any malicious exploitation of this vulnerability.

The largest set of these vulnerabilities were reported by the OUSPG at the
University of Oulu, Finland, in concert with the CERT Coordination Center. A
small number were reported by Cisco customers and some were internally
discovered.

These vulnerabilities are present in other products not provided by Cisco, and
this security advisory is being published simultaneously with announcements
from the other affected organizations.

Status of This Notice: Interim
==============================
This is an interim Security Advisory notice. Cisco anticipates issuing updated
versions of this notice at irregular intervals as there are material changes in
the facts, and will continue to update this notice as necessary.

The reader is warned that this notice may contain inaccurate or incomplete
information. Although Cisco cannot guarantee the accuracy of all statements in
this notice, all of the facts have been checked to the best of our ability.
Cisco anticipates weekly updates of this notice until it reaches final status.

A standalone copy or paraphrase of the text of this Security Advisory that
omits the distribution URL in the following section is an uncontrolled copy,
and may lack important information or contain factual errors.

Distribution
============
This notice will be posted on Cisco's Worldwide Web site at http://
www.cisco.com/warp/public/707/cisco-malformed-snmp-msgs-pub.shtml. In addition
to Worldwide Web posting, a text version of this notice is clear-signed with
the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news
recipients:

  * cust-security-announce@cisco.com
  * bugtraq@securityfocus.com
  * first-teams@first.org (includes CERT/CC)
  * cisco@spot.colorado.edu
  * comp.dcom.sys.cisco
  * firewalls@lists.gnac.com
  * Various internal Cisco mailing lists

Future updates of this notice, if any, will be placed on Cisco's Worldwide Web
server, but may or may not be actively announced on mailing lists or
newsgroups. Users concerned about this problem are encouraged to check the URL
given above for any updates.

Revision History
================
+--------------------------------------------------------------+
|Revision |2002-Feb-12|Initial public release                  |
|Number   |20:00 GMT  |                                        |
|1.0      |           |                                        |
+--------------------------------------------------------------+

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco products,
obtaining assistance with security incidents, and registering to receive
security information from Cisco, is available on Cisco's Worldwide Web site at 
http://www.cisco.com/warp/public/707/sec_incident_response.shtml. This includes
instructions for press inquiries regarding Cisco security notices. All Cisco
Security Advisories are available at http://www.cisco.com/go/psirt.

- - -------------------------------------------------------------------------------

This notice is Copyright 2002 by Cisco Systems, Inc. This notice may be
redistributed freely after the release date given at the top of the text,
provided that redistributed copies are complete and unmodified, and include all
date and version information.

- - -------------------------------------------------------------------------------

- -----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8
Comment: Signed by Sharad Ahlawat, Cisco Systems PSIRT

iQEVAwUBPGmVeg/VLJ+budTTAQHnqAf/eE3x+HOnONPugmDrCfp2TCqBY9bTpqt1
GHP7uUFmxNc0vSVfDX83HtGqoJo+1Ng+fdXMiRXCwP+q1yWBLVyqVEfnASz1qUIt
e6wcUBuzOMsEQMUChiX+dXt7VpFZ+pOXSkttbnrGfnqwNfofvw7jqkWA7aQWP2Qe
PIKH4gew5ApEZleRtw7SBWshQG7MbCJtlylMNrC9+jRfVVYjCcnPjx18BTUDsVRE
5C9uPOZ603rqju0Y/jZYbW2yUTiY0DqoOdaa+csO0q4KIepXnXxhT7gxrLipuhzT
qYFNiVie8q0p5eH/u7lwNuSUtEYiFuIIw6J4hHCc389iFTZgwzVJig==
=pBja
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBPGo21Ch9+71yA2DNAQG4zQP/RZ6ge0lhtRV7KF95nNggPjtyBd4+ye6N
75PEfJvaXvsahIh6TTwdjTd8QoP5/voTGzN349L+eJYEG0LujD5q4cEeNwytRHB/
kDs3AT/L0CMCQwG1f7XHFnKzFdd3wpevEY5HAC/rHrAT21H0Yej3LKqOg33uHZa8
+Iv2JTyaJ5g=
=oroC
-----END PGP SIGNATURE-----