RE: FW: CISCO ALERT - Cisco warns of holes in PIX firewalls
- From: "Stuart Pittwood" <SPittwood@xxxxxxxxxxxxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Wed, 31 Dec 2003 10:07:46 -0000
& for those of us who use PIX's here are the complete advisories
http://www.cisco.com/warp/public/707/cisco-sa-20031215-pix.shtml#softwar
e (PIX)
http://www.cisco.com/warp/public/707/cisco-sa-20031215-fwsm.shtml (FWSM)
-----Original Message-----
From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxxxxxxxxx]
Sent: 19 December 2003 20:48
To: [ISAserver.org Discussion List]
Subject: [isalist] FW: CISCO ALERT - Cisco warns of holes in PIX
firewalls
http://www.ISAserver.org
So much for the miracle of the "hardware" firewall :-)
Network World's Cisco News Alert
Cisco warns of holes in PIX firewalls
By Paul Roberts
IDG News Service, 12/16/03
Network equipment maker Cisco is warning customers about
security holes in its PIX firewall product and firewall software
that runs on the Catalyst 6500 Series and 7600 Series switches.
Cisco issued two security advisories on Monday describing
vulnerabilities that could allow remote attackers to shut down
Cisco firewalls using HTTP or SNMP requests designed to exploit
the weaknesses.
Certain versions of the PIX firewall can be crashed and
restarted in a so-called denial-of-service (DoS) attack when
they receive messages using the SNMP version 3 (SNMPv3)
protocol, an updated version of SNMP, which allows organizations
to monitor the status of network devices. PIX firewalls do not
support SNMPv3, Cisco said.
An SNMP server must be defined for the Cisco firewall in order
for SNMPv3 attack to succeed, Cisco said.
Catalyst switches running the Cisco Firewall Services Module
(FWSM) are also vulnerable to DoS attacks using SNMPv3, Cisco
said. The FWSM is software, based on the PIX Operating System,
that allows Cisco customers to use their high-performance
Catalyst switches as firewalls.
In addition to the SNMPv3 vulnerability, a second buffer
overflow vulnerability discovered in the FWSM could allow a
malicious hacker using either RADIUS or TACACS+ to crash a Cisco
firewall with a user authentication request sent using HTTP,
Cisco said. RADIUS and TACACS+ are both client/server protocols
that allow remote access servers to communicate with a central
authentication server and authorize a remote user's access to a
requested network system or service.
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com No.1
Exchange Server Resource Site: http://www.msexchange.org Windows
Security Resource Site: http://www.windowsecurity.com/ Network Security
Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
spittwood@xxxxxxxxxxxxxxxxx To unsubscribe send a blank email to
$subst('Email.Unsub')
A full list of partners in Amery-Parkes is available for inspection at all of
our offices.
Information contained in this e-mail is intended for the use of the addressee
only, and is confidential and may be the subject of Legal Professional
Privilege. Any dissemination, distribution, copying or use this communication
without prior permission of the addressee is strictly prohibited.
The contents of an attachment to this email may contain software viruses which
could damage your own computer system. Whilst Amery-Parkes has taken every
reasonable precaution to minimise this risk, we do not accept liability for any
damage which you sustain as a result of software viruses. You should carry out
your own virus checks before opening any attachment to this email.
Other related posts:
