Cisco Cisco IOS Software Release 12.2
196
Caveats for Cisco IOS Release 12.2
OL-3513-16 Rev. G0
Resolved Caveats—Cisco IOS Release 12.2(17d)
TCP/IP Host-Mode Services
•
CSCed78149
A document that describes how the Internet Control Message Protocol (ICMP) could be used to
perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol
(TCP) has been made publicly available. This document has been published through the Internet
Engineering Task Force (IETF) Internet Draft process, and is entitled “ICMP Attacks Against TCP”
(draft-gont-tcpm-icmp-attacks-03.txt).
perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol
(TCP) has been made publicly available. This document has been published through the Internet
Engineering Task Force (IETF) Internet Draft process, and is entitled “ICMP Attacks Against TCP”
(draft-gont-tcpm-icmp-attacks-03.txt).
These attacks, which only affect sessions terminating or originating on a device itself, can be of
three types:
three types:
1. Attacks that use ICMP “hard” error messages
2. Attacks that use ICMP “fragmentation needed and Don’t Fragment (DF) bit set” messages, also
known as Path Maximum Transmission Unit Discovery (PMTUD) attacks
known as Path Maximum Transmission Unit Discovery (PMTUD) attacks
3. Attacks that use ICMP “source quench” messages
Successful attacks may cause connection resets or reduction of throughput in existing connections,
depending on the attack type.
depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are
workarounds available to mitigate the effects of the vulnerability.
workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at
The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security
Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple
vendors whose products are potentially affected. Its posting can be found at:
Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple
vendors whose products are potentially affected. Its posting can be found at:
Resolved Caveats—Cisco IOS Release 12.2(17d)
Cisco IOS Release 12.2(17d) is a rebuild release for Cisco IOS Release 12.2(17). The caveats in this
section are resolved in Cisco IOS Release 12.2(17d) but may be open in previous Cisco IOS releases.
section are resolved in Cisco IOS Release 12.2(17d) but may be open in previous Cisco IOS releases.
The following information is provided for each caveat:
•
Symptoms: A description of what is observed when the caveat occurs.
•
Conditions: The conditions under which the caveat has been known to occur.
•
Workaround: Solutions, if available, to counteract the caveat.
IP Routing Protocols
•
CSCed28873
Cisco products running IOS contain vulnerabilities in the processing of H.323 messages, which are
typically used in packetized voice or multimedia applications. Features such as NAT and IOS
Firewall must inspect H.323 messages and may be vulnerable as well. A test suite has been
developed by the University of Oulu to target this protocol and identify vulnerabilities.
typically used in packetized voice or multimedia applications. Features such as NAT and IOS
Firewall must inspect H.323 messages and may be vulnerable as well. A test suite has been
developed by the University of Oulu to target this protocol and identify vulnerabilities.