TITLE:
Cisco Products OpenSSL Potential SSL 2.0 Rollback Vulnerability

SECUNIA ADVISORY ID:
SA17888

VERIFY ADVISORY:
http://secunia.com/advisories/17888/

CRITICAL:
Less critical

IMPACT:
Security Bypass

WHERE:
>From remote

OPERATING SYSTEM:
Cisco PIX 7.x
http://secunia.com/product/6102/
Cisco Mainframe Channel Connection (CMCC)
http://secunia.com/product/6331/
Cisco IOS XR (CRS-1) 3.x
http://secunia.com/product/4907/
Cisco Global Site Selector (GSS) 4480 1.x
http://secunia.com/product/2270/
Cisco ASA 5500 Series Adaptive Security Appliances
http://secunia.com/product/6115/

SOFTWARE:
CiscoWorks Common Services Software 3.x
http://secunia.com/product/6330/
CiscoWorks Common Services Software 2.x
http://secunia.com/product/2266/
Cisco Wireless Control System (WCS) 1.x
http://secunia.com/product/6332/

DESCRIPTION:
Cisco has acknowledged a vulnerability in some products, which
potentially can be exploited by malicious people to bypass certain
security restrictions.

For more information:
SA17151

The vulnerability has been reported in the following products:
* Cisco PIX version 7.0.1 through 7.0.4.2.
* Cisco ASA 5500 version 7.0.4.2. and prior.
* CiscoWorks Common Services (CWCS) version 2.2.
* CiscoWorks Common Services (CWCS) version 3.0.
* Cisco Mainframe Channel Connection (CMCC) version 28-22 and prior.
* Cisco Global Site Selector (4480, 4490, 4491) version 1.2 and
prior.
* Cisco Wireless Control System Software version 4.0 and prior.
* Cisco IOS-XR version 3.3 and prior.

SOLUTION:
Cisco ASA 5500 and Cisco PIX running 7.x software:
Fixed in interim release 7.0.4.3.

CiscoWorks Common Services (CWCS) version 2.2:
Point patch will reportedly be available by 2005-12-07.

CiscoWorks Common Services (CWCS) version 3.0:
Point patch will reportedly be available by 2005-12-16.

Cisco Mainframe Channel Connection (CMCC):
Fixed version 28-23 is reportedly scheduled for release in December
2006.

Cisco Global Site Selector (4480, 4490, 4491):
Fixed in version 1.2(2.2.0).

Cisco Wireless Control System Software:
Fixed version will reportedly be available in February 2006.

Cisco IOS-XR:
Fixed version will reportedly be available in April 2006.

ORIGINAL ADVISORY:
http://www.cisco.com/warp/public/707/cisco-response-20051202-openssl.shtml

OTHER REFERENCES:
SA17151:
http://secunia.com/advisories/17151/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------