Cisco PIX TCP SYN Packet Denial Of Service Vulnerability

Bugtraq ID:	15525
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 22 2005 12:00AM
Updated:	Mar 10 2006 01:15AM
Credit:	"Konstantin V. Gavrilenko" <[email protected]> discovered this issue.
Vulnerable:	Cisco PIX/ASA 7.0.1 .4 Cisco PIX/ASA 7.0 Cisco PIX OS Cisco PIX Firewall 535 0 Cisco PIX Firewall 525 6.3 Cisco PIX Firewall 525 Cisco PIX Firewall 520 Cisco PIX Firewall 515E Cisco PIX Firewall 515 Cisco PIX Firewall 506 0 Cisco PIX Firewall 501 0 Cisco PIX Firewall 6.3.3 (133) Cisco PIX Firewall 6.3.2 Cisco PIX Firewall 6.3.1 Cisco PIX Firewall 6.3 (5) Cisco PIX Firewall 6.3 (3.109) Cisco PIX Firewall 6.3 (3.102) Cisco PIX Firewall 6.3 (3) Cisco PIX Firewall 6.3 (1) Cisco PIX Firewall 6.3 Cisco PIX Firewall 6.2.3 (110) Cisco PIX Firewall 6.2.3 Cisco PIX Firewall 6.2.2 .111 Cisco PIX Firewall 6.2.2 Cisco PIX Firewall 6.2.1 Cisco PIX Firewall 6.2 (3.100) Cisco PIX Firewall 6.2 (3) Cisco PIX Firewall 6.2 (2) Cisco PIX Firewall 6.2 (1) Cisco PIX Firewall 6.2 Cisco PIX Firewall 6.1.5 (104) Cisco PIX Firewall 6.1.5 Cisco PIX Firewall 6.1.4 Cisco PIX Firewall 6.1.3 Cisco PIX Firewall 6.1 (5) Cisco PIX Firewall 6.1 (4) Cisco PIX Firewall 6.1 (3) Cisco PIX Firewall 6.1 (2) Cisco PIX Firewall 6.1 (1) Cisco PIX Firewall 6.1 + Cisco PIX Firewall 515 + Cisco PIX Firewall 520 Cisco PIX Firewall 6.0.4 Cisco PIX Firewall 6.0.3 Cisco PIX Firewall 6.0 (4.101) Cisco PIX Firewall 6.0 (4) Cisco PIX Firewall 6.0 (2) Cisco PIX Firewall 6.0 (1) Cisco PIX Firewall 6.0 + Cisco PIX Firewall 515 + Cisco PIX Firewall 520 Cisco PIX Firewall 5.3 (3) Cisco PIX Firewall 5.3 (2) Cisco PIX Firewall 5.3 (1.200) Cisco PIX Firewall 5.3 (1) Cisco PIX Firewall 5.3 + Cisco PIX Firewall 515 + Cisco PIX Firewall 520 Cisco PIX Firewall 5.2 (9) Cisco PIX Firewall 5.2 (7) Cisco PIX Firewall 5.2 (6) Cisco PIX Firewall 5.2 (5) Cisco PIX Firewall 5.2 (3.210) Cisco PIX Firewall 5.2 (2) Cisco PIX Firewall 5.2 (1) Cisco PIX Firewall 5.2 Cisco PIX Firewall 5.1.4 Cisco PIX Firewall 5.1 (4.206) Cisco PIX Firewall 5.1 + Cisco PIX Firewall 515 + Cisco PIX Firewall 520 Cisco PIX Firewall 5.0 + Cisco PIX Firewall 515 + Cisco PIX Firewall 520 Cisco PIX Firewall 4.4 (8) Cisco PIX Firewall 4.4 (7.202) Cisco PIX Firewall 4.4 (4) Cisco PIX Firewall 4.4 Cisco PIX Firewall 4.3 Cisco PIX Firewall 4.2.2 Cisco PIX Firewall 4.2.1 Cisco PIX Firewall 4.2 (5) Cisco PIX Firewall 4.2 Cisco PIX Firewall 4.1.6 b Cisco PIX Firewall 4.1.6 Cisco PIX Firewall 4.0 Cisco PIX Firewall 3.1 Cisco PIX Firewall 3.0 Cisco PIX Firewall 2.7
Not Vulnerable:

Cisco PIX TCP SYN Packet Denial Of Service Vulnerability

Cisco PIX is susceptible to a remote denial-of-service vulnerability when handling certain TCP SYN packets.

This issue allows attackers to temporarily block network traffic to arbitrarily targeted TCP services. By repeating the attack, a prolonged denial-of-service condition is possible.

This issue is tracked by the following Cisco Bug IDs:
- CSCsc14915: PIX 6.3 Spoofed TCP SYN packets can block legitimate TCP connections
- CSCsc16014: PIX 7.0 Spoofed TCP SYN packets can block legitimate TCP connections

Cisco PIX TCP SYN Packet Denial Of Service Vulnerability

An exploit is not required.

A sample Perl application designed to send TCP SYN packets with invalid checksums is provided by Janis Vizulis, Arhont Ltd.:

• /data/vulnerabilities/exploits/PIXdos.pl

Cisco PIX TCP SYN Packet Denial Of Service Vulnerability

Solution:
Cisco has responded to this issue, and assigned Cisco Bug ID CSCsc14915 to PIX 6.3, and CSCsc16014 to PIX 7.0. Please see the referenced message for further information.

Cisco PIX TCP SYN Packet Denial Of Service Vulnerability

References:

• Cisco PIX embryonic state machine TTL(n-1) DoS and Cisco PIX embryonic state mac (Randy Ivener)
  
• Cisco PIX TCP Connection Prevention ("Randy Ivener \(rivener\)" )
  
• Cisco PIX TCP Connection Prevention ("Konstantin V. Gavrilenko" )
  
• Cisco PIX embryonic state machine TTL(n-1) DoS ("Konstantin V. Gavrilenko" )