Cisco Catalyst 6500/7600 Series Firewall Services Module ACL Bypass Vulnerability

Bugtraq ID:	13595
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 11 2005 12:00AM
Updated:	May 11 2005 12:00AM
Credit:	This vulnerability was reported to Cisco by a customer.
Vulnerable:	Cisco FWSM for Cisco Catalyst 6500/7600 Series 2.3.1 Cisco FWSM for Cisco Catalyst 6500/7600 Series 1.1 (3.17) Cisco FWSM for Cisco Catalyst 6500/7600 Series
Not Vulnerable:

Cisco Catalyst 6500/7600 Series Firewall Services Module ACL Bypass Vulnerability

Cisco FWSM (Firewall Services Module) is prone to a vulnerability that may allow traffic that is explicitly filtered to bypass ACLs. As a result, unauthorized TCP traffic may bypass the firewall.

This issue only affects Cisco Catalyst 6500 Series Switches and Cisco 7600 series routers running FWSM version 2.3.1 or earlier when using content filtering exceptions.

Cisco Catalyst 6500/7600 Series Firewall Services Module ACL Bypass Vulnerability

There is no exploit required to leverage this vulnerability on affected devices.

Cisco Catalyst 6500/7600 Series Firewall Services Module ACL Bypass Vulnerability

Solution:
Affected Cisco FWSM users may address the issue by upgrading to FWSM 2.3(2). Cisco has also made interim fixes are available from Cisco TAC. Affected users running FWSM 2.2 may upgrade to version 2.2(1)18 or later and 1.1 users may upgrade to FWSM 1.1(4)4 or later.

Cisco Catalyst 6500/7600 Series Firewall Services Module ACL Bypass Vulnerability

References:

• Cisco Security Advisory: FWSM URL Filtering Solution TCP ACL Bypass Vulnerabilit (Cisco)