Cisco IPS/IDS Fragmented Packets Inspection Bypass Vulnerability

Bugtraq ID:	20127
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 20 2006 12:00AM
Updated:	Sep 21 2006 06:46PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Cisco Intrusion Prevention System 5.0 (3) Cisco Intrusion Prevention System 5.0 (2) Cisco Intrusion Prevention System 5.0 (1) Cisco Intrusion Prevention System 5.1(p1) Cisco Intrusion Prevention System 5.1(1e) Cisco Intrusion Prevention System 5.1(1d) Cisco Intrusion Prevention System 5.1(1c) Cisco Intrusion Prevention System 5.1(1b) Cisco Intrusion Prevention System 5.1(1b) Cisco Intrusion Prevention System 5.1(1) Cisco Intrusion Prevention System 5.1 (1a) Cisco Intrusion Prevention System 5.0(6p1)
Not Vulnerable:	Cisco Intrusion Prevention System 5.1(2) Cisco Intrusion Prevention System 5.0(6p2)

Cisco IPS/IDS Fragmented Packets Inspection Bypass Vulnerability

Cisco Intrusion Prevention and Intrusion Detection Systems are prone to an inspection-bypass vulnerability.

An attacker can exploit this issue to bypass the inspection mechanism. This may allow attackers to covertly attack presumably protected systems.

This issue is being tracked by Cisco bug IDs CSCse17206 and CSCsf12379.

Cisco IPS/IDS Fragmented Packets Inspection Bypass Vulnerability

Attackers can use standard network utilities to exploit this issue.

Cisco IPS/IDS Fragmented Packets Inspection Bypass Vulnerability

Solution:
The vendor has released an advisory along with fixes to address this issue. Please see the referenced advisory for information on obtaining fixes.

Cisco IPS/IDS Fragmented Packets Inspection Bypass Vulnerability

References:

• Cisco Intrusion Prevention System Home Page (Cisco)
  
• Cisco Security Advisory: Cisco Intrusion Prevention System Management Interface (Cisco)
  
• Vulnerability Note VU#658884 - Cisco IPS fails to properly check fragmented IP p (Cisco)
  
• Cisco Security Advisory: Cisco Intrusion Prevention System Management Interface (Cisco)