FWSM
Products Confirmed Not Vulnerable
- ---------------------------------
Other Cisco products that offer firewall services, including Cisco IOS
Software, Cisco ASA 5500 Series Adaptive Security Appliances, and Cisco
PIX Security Appliances, are not affected by this vulnerability.
No other Cisco products are currently known to be affected by this
vulnerability.
Details
Hash: SHA256
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Firewall
Services Module
Advisory ID: cisco-sa-20111005-fwsm
Revision 1.0
For Public Release 2011 October 05 1600 UTC (GMT)
FWSM Version: 3.1(3)
Products Confirmed Not Vulnerable
+--------------------------------
With the exception of the Cisco PIX 500 Series Security Appliances and
the Cisco ASA 5500 Series Adaptive Security Appliances, no other Cisco
products are known to be vulnerable to the issues described in this
advisory.
Details
+--------------------------------
* FWSM System Software versions 3.2(2) and earlier.
* FWSM System Software versions 3.1(x).
* FWSM System Software versions 1.x(y) and 2.x(y).
* The Cisco PIX 500 Series Security Appliance (PIX)
* The Cisco 5500 Series Adaptive Security Appliance (ASA).
No other Cisco products are currently known to be affected by this
vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Multiple Vulnerabilities in Cisco PIX and
Cisco ASA
Document ID: 105444
Advisory ID: cisco-sa-20080604-asa
Hash: SHA1
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Firewall
Services Module
Advisory ID: cisco-sa-20100804-fwsm
Revision 1.0
For Public Release 2010 August 04 1600 UTC (GMT)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA Adaptive
Security Appliance and Cisco PIX Security Appliances
Advisory ID: cisco-sa-20090408-asa
http://www.cisco.com/warp/public/707/cisco-sa-20090408-asa.shtml
Hash: SHA1
Cisco Security Advisory: Cisco Firewall Services Module Skinny Client
Control Protocol Inspection Denial of Service Vulnerability
Advisory ID: cisco-sa-20100217-fwsm
http://www.cisco.com/warp/public/707/cisco-sa-20100217-fwsm.shtml
Revision 1.0
Cisco Security Advisory: Cisco Firewall Services Module Skinny Client
Control Protocol Inspection Denial of Service Vulnerability
Document ID: 112893
Advisory ID: cisco-sa-20110223-fwsm
Revision 1.0
For Public Release 2011 February 23 1600 UTC (GMT)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Remote Access VPN and SIP Vulnerabilities in
Cisco PIX and Cisco ASA
Advisory ID: cisco-sa-20080903-asa
Revision 1.0
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Multiple Vulnerabilities in Cisco PIX and
Cisco ASA
Advisory ID: cisco-sa-20081022-asa
http://www.cisco.com/warp/public/707/cisco-sa-20081022-asa.shtml
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Multiple Vulnerabilities in Cisco PIX and ASA
Appliances
Advisory ID: cisco-sa-20071017-asa
http://www.cisco.com/warp/public/707/cisco-sa-20071017-asa.shtml
Products Confirmed Not Vulnerable
Cisco PIX and ASA security appliances which do not support the TTL decrement
feature or are not explicitly configured for it are not vulnerable.
Note: The TTL decrement feature was introduced in version 7.2(2), and it is
disabled by default. The Cisco Firewall Services Module (FWSM) is not
vulnerable.
Eric Davis
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Cisco PIX and ASA Time-to-Live Vulnerability
Advisory ID: cisco-sa-20080123-asa
http://www.cisco.com/warp/public/707/cisco-sa-20080123-asa.shtml
Revision 1.0
Server Address: 192.168.10.11
Server port: 139
Server status: ACTIVE, Last transaction (success) at 11:10:08 UTC Fri Jan 29
<output truncated>
Cisco PIX 500 Series Security Appliance Vulnerability Status
+-----------------------------------------------------------
Cisco PIX 500 Series Security Appliances are affected by the
following vulnerabilities:
Cisco ASA 5500 Series Adaptive Security Appliance versions 7.0.x,
7.1.x, 7.2.x, 8.0.x, 8.1.x, and 8.2.x are affected. IKE is not
enabled by default. If IKE is enabled, the "isakmp enable <interface
name>" command appears in the configuration.
Cisco PIX 500 Series Security Appliance Vulnerability Status
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Cisco PIX 500 Series Security Appliances are affected by the SunRPC,
TLS, and IKE message DoS vulnerabilities.
http server enable
The local CA server is not enabled by default.
Cisco PIX 500 Series Security Appliance Vulnerability Status
+-----------------------------------------------------------
Cisco PIX 500 Series Security Appliances are affected by the
Transparent Firewall Packet Buffer Exhaustion Vulnerability and the
SCCP Inspection Denial of Service Vulnerability.
advisory.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20111005-asa.shtml.
Note: The Cisco Firewall Services Module (FWSM) is affected by the
TACACS+ authentication bypass vulnerability, SunRPC Inspection denial
of service (DoS) vulnerabilities and ILS inspection DoS
vulnerability. A separate Cisco Security Advisory has been published
to disclose the vulnerabilities that affect the FWSM. This advisory
is available at:
+--------------------------------
No other Cisco products are currently known to be affected by this
vulnerability. Products confirmed not vulnerable include:
* Cisco PIX 500 Series Firewall
* Cisco ASA 5500 Series Adaptive Security Appliance
* Firewall Services Module (FWSM) for Catalyst 6500 Series Switches
and 7600 Series Routers
* Virtual Firewall (VFW) application on the multiservice blade
(MSB) on the Cisco XR 12000 Series Router
Cisco IPSec VPN Implementation Group Name Enumeration
01/12/2010
Gavin Jones of NGS Secure has discovered a vulnerability in (Cisco) Cisco VPN Concentrator, Cisco PIX and Cisco Adaptive Security Appliance.
Versions affected include:
-Cisco ASA 5500 Series Adaptive Security Appliances
-Cisco PIX 500 Series Security Appliances
Products Confirmed Not Vulnerable
+--------------------------------
The following Cisco products are confirmed not vulnerable:
* Cisco PIX Security Appliances
* Cisco ASA Security Appliances
* Cisco Firewall Services Module (FWSM)
* Cisco Security Monitoring, Analysis, and Response System (MARS)
* Cisco Network Admission Control (NAC) Appliance
* CiscoWorks Wireless LAN Solution Engine (WLSE)
Products Confirmed Not Vulnerable
+--------------------------------
The following products are confirmed not vulnerable:
* Cisco PIX 500 Series Firewall
* Cisco ASA 5500 Series Adaptive Security Appliance
* Firewall Services Module (FWSM) for Catalyst 6500 Series Switches
and 7600 Series Routers
* Virtual Firewall (VFW) application on the multiservice blade
(MSB) on the Cisco XR 12000 Series Router
No other Cisco products are currently known to be affected by this
vulnerability. IOS releases before 12.4(9)T are not affected by this
issue. Products confirmed not vulnerable include:
* Cisco PIX
* Cisco ASA
* Cisco Firewall Services Module (FWSM)
* The Virtual Firewall (VFW) application on the multiservice blade
(MSB) on the Cisco XR 12000 Series Router
|----------------------------+-------------------------------|
| Cisco Catalyst 6500 Series | CSCtd06389 |
| SSL Services Module | |
|----------------------------+-------------------------------|
| Firewall Services Module | CSCtd04061 |
| FWSM | |
|----------------------------+-------------------------------|
| Cisco CSS 11000 Series | CSCtd01636 |
| Content Services Switches | |
|----------------------------+-------------------------------|
| Cisco Unified SIP Phones | CSCtd01446 |
The following Cisco products are confirmed not vulnerable:
* Cisco IOS devices running the Intrusion Detection System feature
* Cisco ASA Security Appliances running the Intrusion Detection
System feature
* Cisco PIX 500 Series Security Appliances running the Intrusion
Detection System feature
* Cisco IPS 4200 Sensors
* Cisco AIP-SSM for ASA 5500 Series Adaptive Security Appliances
* Cisco Catalyst 6500 Series Intrusion detection System (IDSM-2)
Services Module
Release Date: 22 March 2011
Reference: NGS00014
Discoverer: Gavin Jones
Vendor: Cisco
Vendor Reference: CSCei51783, CSCtj96108
Systems Affected: ASA 5500 Series Adaptive Security Appliances -Cisco PIX 500 Series Security Appliances -Cisco VPN 3000 Series Concentrators (models 3005, 3015, 3020, 3030, 3060, and 3080)
Risk: Low
Status: Published
========
TimeLine
I tried this on my 515E with 'Cisco PIX Security Appliance Software
Version 7.1(1)' I also uses radius for auth, and I couldn't reproduce
this exploit. This may just be a 7.1 issue.
tbbunn@ctc.net wrote:
> I actually was able to reproduce this attack multiple times, and did verify that there was an enable secret password configured(as well as multiple User/Passwords on the TTY line, not that they should matter) . I will not be in my lab until Tuesday of next week, but I will reproduce this again and copy the exact configuration. I can not really argue any points until then. I really appreciate you'll looking into the matter. Again this was reproduced on a PIX 515E running v7.2 of Finesse.
>
> Terry Bunn,CCNA
> tbbunn@ctc.net
>
|
