Cisco Cisco IOS Software Release 12.0 S 릴리즈 노트

CSCed78149

A document that describes how the Internet Control Message Protocol (ICMP) could be used to 
perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol 
(TCP) has been made publicly available. This document has been published through the Internet 
Engineering Task Force (IETF) Internet Draft process, and is entitled “ICMP Attacks Against TCP” 
(draft-gont-tcpm-icmp-attacks-03.txt).

These attacks, which only affect sessions terminating or originating on a device itself, can be of 
three types:

Attacks that use ICMP “hard” error messages.

Attacks that use ICMP “fragmentation needed and Don’t Fragment (DF) bit set” messages, also 
known as Path Maximum Transmission Unit Discovery (PMTUD) attacks.

Attacks that use ICMP “source quench” messages.

Successful attacks may cause connection resets or reduction of throughput in existing connections, 
depending on the attack type.

Multiple Cisco products are affected by the attacks described in this Internet draft.

Cisco has made free software available to address these vulnerabilities. In some cases there are 
workarounds available to mitigate the effects of the vulnerability.

This advisory is posted at 

The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security 
Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple 
vendors whose products are potentially affected. 

All the caveats listed in this section are resolved in Cisco IOS Release 12.0(29)S. This section describes 
only severity 1, severity 2, and select severity 3 caveats.

CSCdx55178

Symptoms: Difficulties may occur when you attempt to remotely log in to a Cisco router that 
supports ATM. After you have established a virtual terminal connection to the system, the following 
user access verification sequence may be displayed, and the connection terminated:

Password:

Password:

Password:

% Bad passwords

Conditions: This symptom is observed on a Cisco router that support ATM when an interactive ATM 
ping is terminated abnormally.

Workaround: Instead of using an interactive ATM ping, enter the ping atm interface atm interface 
vpi vci [seg-loopback | end-loopback] [repeat [timeout]] privileged EXEC command.