Cisco Pix contains a flaw that may allow a remote denial of service. The issue is triggered when an attacker sends a specially crafted SYN packet, and will result in loss of availability for the current connection.

The malformed SYN packets are sent through the PIX firewall, and are dropped by the host on the inside network without issuing a RST. The PIX maintains an half open state through for either 120 seconds or 30 seconds depending on your PIX software version. The embryonic timeout value does not allow further traffic to pass until the inside host responds back to the originator, or the timeout value has expired. Since the inside host dropped the malformed packet and did not issue a RST, the Pix will wait for the embryonic timeout value to expire before allowing traffic to pass through that connection once again.

Upgrade to version 6.3(5.106) , 7.0(4.5) or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround(s):
1.) Adjusting the embryonic state connection timeout value.
2.) Enable TCP Intercept
3.) "clear xlate" or "clear local-host" commands to allow the connection

• Security Tracker: 1015256
• Bugtraq ID: 15525
• Secunia Advisory ID: 17670
• CVE ID: 2005-3774 (see also: NVD)
• Related OSVDB ID: 21053 24140
• ISS X-Force ID: 25077 25079
• CERT VU: 853540
• VUPEN Advisory: ADV-2005-2546
• Keyword: CSCsc14915,CSCsc16014
• Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2006-03/0148.html
  http://archives.neohapsis.com/archives/fulldisclosure/2006-03/0149.html
  http://archives.neohapsis.com/archives/fulldisclosure/2006-03/0150.html
  http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/038971.html
  http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/038983.html
  http://www.securityfocus.com/archive/1/archive/1/417458/30/0/threaded
  http://www.securityfocus.com/archive/1/archive/1/426989/100/0/threaded
  http://www.securityfocus.com/archive/1/archive/1/426991/100/0/threaded
  http://www.securityfocus.com/archive/1/archive/1/427041/100/0/threaded
• Packet Storm: http://packetstormsecurity.org/0603-advisories/arh200511-1.txt
• Vendor Specific News/Changelog Entry: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_security_notice09186a0080624a37.html
• Vendor Specific Advisory URL: http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_security_notice09186a008059a411.html
• Other Advisory URL: http://www.cisco.com/warp/public/707/cisco-response-20051122-pix.shtml
• Vendor URL: www.cisco.com

• Konstantin V. Gavrilenko - k.gavrilenkoarhont.com - Arhont Ltd - Information Security