Cisco Systems has warned customers about security holes in its Pix firewall product and firewall software running on the Catalyst 6500 Series and 7600 Series switches.
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
The vulnerabilities could allow remote attackers to shut down Cisco firewalls using HTTP or SNMP requests designed to exploit the weaknesses.
Certain versions of the Pix firewall can be crashed and restarted in a so-called denial of service attack when they receive messages using the SNMP version 3 (SNMPv3) protocol, an updated version of SNMP, which allows organisations to monitor the status of network devices. Pix firewalls do not support SNMPv3. (See: http://www.cisco.com/warp/public/707/cisco-sa-20031215-pix.shtml.)
An SNMP server must be defined for the Cisco firewall for an SNMPv3 attack to succeed, Cisco said.
Catalyst switches running the Cisco Firewall Services Module (FWSM) are also vulnerable to DoS attacks using SNMPv3. The FWSM is software, based on the Pix Operating System, which allows Cisco customers to use their high-performance Catalyst switches as firewalls. (See: http://www.cisco.com/warp/public/707/cisco-sa-20031215-fwsm.shtml.)
A second buffer overflow vulnerability discovered in the FWSM could allow a malicious hacker using either Radius (Remote Authentication Dial-In User Service ) or TACACS+ (Terminal Access Controller Access Control System) to crash a Cisco firewall with a user authentication request sent using HTTP.
Radius and Tacacs+ are both client/server protocols that allow remote access servers to communicate with a central authentication server and authorise a remote user's access to a requested network system or service.
PIX firewalls running software versions 6.3.1, 6.2.2 and earlier, version 6.1.4 and earlier and version 5.x.x and earlier are all vulnerable to the SNMPv3 security hole, as are Catalyst 6500 and 7600 series switches running FWSM software up to and including version 1.1.2.
Catalyst switches running FWSM software up to and including version 1.1.2 are also vulnerable to the HTTP authentication vulnerability.
Cisco is offering free software upgrades for customers using affected hardware and software.
Paul Roberts writes for IDG News Service