Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

System Vulnerability through PIX

The following vulnerability is showing up on systems when scanned through our PIX firewall(with all ICMP except echo-replies blocked).

http://www.iss.net/security_center/reference/vuln/icmp-nofragment-lowmtu-dos.htm

Can anyone explain why this would happen? The firewall should mitigate all vulnerabilities of this type since ICMP is blocked...

1 REPLY

Re: System Vulnerability through PIX

Hi Jonathan,

Your PIX is only vulnerable if you are running 6.3 code or earlier and have IPsec enabled (which is not enabled by default). The vulnerability is due to CSCef57566. Also, I would recommend taking a look at the follow link, which has all the details of this vulnerability:

http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml

As a workaround, you can disable IPSec, though this is probably not a viable solution for you. Therefore, to be protected against this vulnerability, you should upgrade to the latest 6.3.5.x interim release, or move to the 7.x or 8.x trains where this vulnerability does not exist.

Hope that helps.

-Mike

149
Views
0
Helpful
1
Replies