System Vulnerability through PIX

Unanswered Question
Jul 10th, 2008
User Badges:

The following vulnerability is showing up on systems when scanned through our PIX firewall(with all ICMP except echo-replies blocked).


http://www.iss.net/security_center/reference/vuln/icmp-nofragment-lowmtu-dos.htm


Can anyone explain why this would happen? The firewall should mitigate all vulnerabilities of this type since ICMP is blocked...

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
robertson.michael Fri, 08/15/2008 - 18:24
User Badges:
  • Silver, 250 points or more

Hi Jonathan,


Your PIX is only vulnerable if you are running 6.3 code or earlier and have IPsec enabled (which is not enabled by default). The vulnerability is due to CSCef57566. Also, I would recommend taking a look at the follow link, which has all the details of this vulnerability:

http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml


As a workaround, you can disable IPSec, though this is probably not a viable solution for you. Therefore, to be protected against this vulnerability, you should upgrade to the latest 6.3.5.x interim release, or move to the 7.x or 8.x trains where this vulnerability does not exist.


Hope that helps.


-Mike

Actions

This Discussion