Cisco warns of holes in PIX firewalls

Network equipment maker Cisco Systems Inc. is warning customers about security holes in its PIX firewall product and firewall software that runs on the Catalyst 6500 Series and 7600 Series switches.

Cisco issued two security advisories on Monday describing vulnerabilities that could allow remote attackers to shut down Cisco firewalls using HTTP or Simple Network Management Protocol (SNMP) requests designed to exploit the weaknesses.

Certain versions of the PIX firewall can be crashed and restarted in a so-called denial of service (DoS) attack when they receive messages using the SNMP version 3 (SNMPv3) protocol, an updated version of SNMP, which allows organizations to monitor the status of network devices. PIX firewalls do not support SNMPv3, Cisco said.

An SNMP server must be defined for the Cisco firewall in order for SNMPv3 attack to succeed, Cisco said.

Catalyst switches running the Cisco Firewall Services Module (FWSM) are also vulnerable to DoS attacks using SNMPv3, Cisco said. The FWSM is software, based on the PIX Operating System, that allows Cisco customers to use their high-performance Catalyst switches as firewalls.

In addition to the SNMPv3 vulnerability, a second buffer overflow vulnerability discovered in the FWSM could allow a malicious hacker using either Remote Authentication Dial-In User Service (RADIUS) or Terminal Access Controller Access Control System (TACACS+) to crash a Cisco firewall with a user authentication request sent using HTTP, Cisco said. RADIUS and TACACS+ are both client/server protocols that allow remote access servers to communicate with a central authentication server and authorize a remote user’s access to a requested network system or service.

PIX firewalls running software versions 6.3.1, 6.2.2 and earlier, version 6.1.4 and earlier and version 5.x.x and earlier are all vulnerable to the SNMPv3 security hole, as are Catalyst 6500 and 7600 series switches running FWSM software up to and including version 1.1.2, Cisco said.

Catalyst switches running FWSM software up to and including version 1.1.2 are also vulnerable to the HTTP authentication vulnerability, the company said.

Cisco is the world’s biggest supplier of network firewall hardware, competing with companies such as Nokia Corp. and NetScreen Technologies Inc., according to research firm IDC.

Cisco is offering free software upgrades for customers using affected hardware and software.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Article

ADaPT connects employers with highly skilled young workers

Help wanted. That’s what many tech companies across Canada are saying, and research shows that as the demand for skilled workers...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now