[Full-Disclosure] Potential denial of service bug in Cisco Pix Firewall IOS resolve d in 6.3.(3)105

John.Airey_at_rnib.org.uk
Date: 01/05/04

  • Next message: Paul Starzetz: "[VulnWatch] Linux kernel mremap vulnerability" 
    To: full-disclosure@lists.netsys.com
Date: Mon, 5 Jan 2004 14:55:15 -0000

    Brief Description
    -----------------

    Users of Cisco Pix Firewalls may discover that their pool of NAT'ted IP
    addresses is running out, and that a reboot, reload or "clear xlate" on the
    firewall clears the problem.

    Details
    -------

    The problem is caused by the Firewall being swamped by incoming ICMP packets
    on the global pool IP addresses. If these are not intercepted by a router
    beforehand, the incoming echo requests (that are emanating from
    Nachi/Welchia worm infected machines) are preventing the release of the
    address translation. ie, the Pix is detecting the blocked traffic as
    indication that the translation is still in use.

    Permanent fix
    -------------

    I have been informed by Cisco that this is resolved in 6.3(3)105. The
    relevant case ID is CSCec 47609 detailed at
    www.cisco.com/cgi-bin/Support/Bugtool/onebug.pl?bugid=CSCec47609 and
    referenced at
    www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note09186a00801b
    143a.shtml

    This is probably also fixed in later IOS versions.

    -
    John Airey, BSc (Jt Hons), CNA, RHCE
    Internet systems support officer, ITCSD, Royal National Institute of the
    Blind,
    Bakewell Road, Peterborough PE2 6XU,
    Tel.: +44 (0) 1733 375299 Fax: +44 (0) 1733 370848 John.Airey@rnib.org.uk

    Even if you win the rat race, that will still only make you a rat.

    -
    DISCLAIMER:

    NOTICE: The information contained in this email and any attachments is
    confidential and may be privileged. If you are not the intended
    recipient you should not use, disclose, distribute or copy any of the
    content of it or of any attachment; you are requested to notify the
    sender immediately of your receipt of the email and then to delete it
    and any attachments from your system.

    RNIB endeavours to ensure that emails and any attachments generated by
    its staff are free from viruses or other contaminants. However, it
    cannot accept any responsibility for any such which are transmitted.
    We therefore recommend you scan all attachments.

    Please note that the statements and views expressed in this email and
    any attachments are those of the author and do not necessarily represent
    those of RNIB.

    RNIB Registered Charity Number: 226227

    Website: http://www.rnib.org.uk

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Paul Starzetz: "[VulnWatch] Linux kernel mremap vulnerability"

    Relevant Pages

    • [Full-Disclosure] Potential denial of service bug in Cisco Pix Firewall IOS resolve d in 6.3(3)105
      ... Users of Cisco Pix Firewalls may discover that their pool of NAT'ted IP ... The problem is caused by the Firewall being swamped by incoming ICMP packets ... The information contained in this email and any attachments is ...
      (Full-Disclosure)
    • [Full-Disclosure] Potential denial of service bug in Cisco Pix Firewall IOS 6.2.2 a nd 6.3.(3.102)
      ... Users of Cisco Pix Firewalls may discover that their pool of NAT'ted IP ... The problem is caused by the Firewall being swamped by incoming ICMP packets ... The information contained in this email and any attachments is ...
      (Full-Disclosure)
    • Re: Workstations Cannot Download Large Emails
      ... When we try to download emails with large attachments, ... minutes (much more than enough for a 4MB download). ... Turning off the firewall software's email/cookie/etc. ... Microsoft Windows Critical Updates and Microsoft Office ...
      (microsoft.public.win2000.networking)
    • Re: *** VIRUS WARNING!!! ***
      ... attachments sent by strangers, and be very careful when opening ... In my personal case, nslookup probably wasn't used. ... I cannot install a Firewall because I only have ... net stop "remote access auto connection manager" ...
      (microsoft.public.win2000.general)
    • RE: ipfw and its glory...
      ... :Natd on a firewall? ... Firewalling a public network? ... If this message contains password-protected attachments, the files have NOT been scanned for viruses by the ING mail domain. ...
      (FreeBSD-Security)