Menu
Cisco fixes TCP denial-of-service bug

Cisco fixes TCP denial-of-service bug

Cisco this week issued a patch for a denial-of-service vulnerability that affects multiple products.

The vulnerability allows attackers to manipulate the state of TCP connections, according to a Cisco security advisory released this week. By manipulating the state of a TCP connection, an attacker could force the TCP connection to remain in a long-lived state, possibly indefinitely, the Cisco advisory states.

Review: ASR 1000 ready to replace aging Cisco routers

If enough TCP connections are forced into a long-lived or indefinite state, system resources may be consumed, preventing new TCP connections from being accepted and thus initiating a DoS condition. To exploit these vulnerabilities, an attacker must be able to complete a TCP three-way handshake with a vulnerable system, the advisory states.

The bug was first discovered a year ago by Outpost24, a Swedish provider of network security products.

Affected products include scores of routers and switches running IOS, IOS-XE and CatOS operating systems; Cisco ASA and Cisco PIX security appliances running versions 7.0, 7.1, 7.2, 8.0, and 8.1 under certain configurations; NX-OS-based products such as the new Nexus 5000 and 7000 swsitches; and Scientific-Atlanta and Linksys products.

In addition to these vulnerabilities, Nexus 5000 switches contain a TCP DoS vulnerability that may result in a system crash, the Cisco advisory states. This vulnerability can be exploited remotely without authentication and without user interaction, and repeated attempts to exploit this vulnerability could result in a sustained DoS condition.

Cisco says it has released free software updates for download from its Web site that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are also available, the company says.

Cisco declined further comment on the situation.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Events

Featured

Slideshows

Channel kicks 2021 into gear as After Hours returns to Auckland

Channel kicks 2021 into gear as After Hours returns to Auckland

After Hours made a welcome return to the channel social calendar with a bumper crowd of partners, distributors and vendors descending on The Pantry at Park Hyatt in Auckland to kick-start 2021.

Channel kicks 2021 into gear as After Hours returns to Auckland
The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

Hundreds of leaders from the New Zealand IT industry gathered at the Hilton in Auckland on 17 November to celebrate the finest female talent in the Kiwi channel and recognise the winners of the Reseller News Women in ICT Awards (WIICTA) 2020.

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards
Show Comments