TITLE:
Cisco PIX Spoofed TCP SYN Packets Denial of Service

SECUNIA ADVISORY ID:
SA17670

VERIFY ADVISORY:
http://secunia.com/advisories/17670/

CRITICAL:
Not critical

IMPACT:
DoS

WHERE:
>From remote

OPERATING SYSTEM:
Cisco PIX 7.x
http://secunia.com/product/6102/
Cisco PIX 6.x
http://secunia.com/product/56/

DESCRIPTION:
Konstantin V. Gavrilenko has reported a vulnerability in Cisco PIX,
which can be exploited by malicious people to cause a DoS (Denial of
Service).

The vulnerability is caused due to the firewall failing to verify the
checksum of a TCP SYN packet before it is allowed through the firewall
and a connection state is setup to track the half-open connection.
Packets with incorrect checksum values will be silently discarded by
the destination host without a RST reply. This causes the connection
state to be held up to two minutes before it is cleared. In the
meantime, legitimate SYN packets with the same protocol, IP
addresses, and ports are discarded by the firewall.

Successful exploitation allows an attacker to prevent a host from
establishing connections to another host through the firewall.

The vulnerability has been reported in PIX 6.3 and PIX/ASA 7.0.

SOLUTION:
The vendor recommends the following workaround.

1) Issue the commands "clear xlate" or "clear local-host <ip address
on the higher security level interface>" to allow the firewall to
pass connections again.

2) Modify the default TCP embryonic connection timeout to a lower
value. e.g. 10 seconds.

3) Configure TCP Intercept to allow PIX to proxy all TCP connection
attempts originated from behind any firewall interface after the
first connection.

4) Cisco PIX/ASA software version 7.0 can be configured to verify TCP
checksums. This will have a performance impact.

PROVIDED AND/OR DISCOVERED BY:
Konstantin V. Gavrilenko, Arhont Ltd

ORIGINAL ADVISORY:
http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/038971.html
http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/038983.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------