Cisco Cisco IOS Software Release 12.2

CSCef44699

A document that describes how the Internet Control Message Protocol (ICMP) could be used to 
perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol 
(TCP) has been made publicly available. This document has been published through the Internet 
Engineering Task Force (IETF) Internet Draft process, and is entitled “ICMP Attacks Against TCP” 
(draft-gont-tcpm-icmp-attacks-03.txt).

These attacks, which only affect sessions terminating or originating on a device itself, can be of 
three types:

1. Attacks that use ICMP “hard” error messages 
2. Attacks that use ICMP “fragmentation needed and Don’t Fragment (DF) bit set” messages, also 
known as Path Maximum Transmission Unit Discovery (PMTUD) attacks 
3. Attacks that use ICMP “source quench” messages

Successful attacks may cause connection resets or reduction of throughput in existing connections, 
depending on the attack type.

Multiple Cisco products are affected by the attacks described in this Internet draft.

Cisco has made free software available to address these vulnerabilities. In some cases there are 
workarounds available to mitigate the effects of the vulnerability.

http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml

.

The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security 
Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple 
vendors whose products are potentially affected. Its posting can be found at: 

.

Cisco IOS Release 12.2(23d) is a rebuild release for Cisco IOS Release 12.2(23). The caveats in this 
section are resolved in Cisco IOS Release 12.2(23d) but may be open in previous Cisco IOS releases.

The following information is provided for each caveat:

Symptoms: A description of what is observed when the caveat occurs. 

Conditions: The conditions under which the caveat has been known to occur. 

Workaround: Solutions, if available, to counteract the caveat. 

CSCee22810

Symptoms: A Cisco 7500 may experience a random status down of all PVCs at once for about 2 
minutes before they come back up. During the DLCI down status, the subinterface does not go down 
and no notifications were observed in the message log.

Conditions: This has been observed on multiple Cisco 7500 routers with RSP8 or RPS4+ running 
version rsp-jsv-mz.122-12i with Frame Relay configured on an 8-port port adapter and HSSI for 
450+PVC/DLCIs.

Workaround: There is no workaround.