PT-2005-4527 · Cisco · Cisco Pix

Jeff S Havrilla · Published 2005-11-23 · Updated 2018-10-19 · CVE-2005-3774

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Cisco PIX versions 6.3 through 7.0

Description The issue allows remote attackers to cause a denial of service by blocking new connections via spoofed TCP packets. This can be achieved by sending SYN packets with invalid checksums, which do not result in a RST, or by sending one byte of "meaningless data" from an external interface, or by using a TTL that is one less than needed to reach the internal destination.

Recommendations For Cisco PIX versions 6.3 through 7.0, consider implementing firewall rules to filter out spoofed TCP packets and restrict access to the external interface to minimize the risk of exploitation. Additionally, monitor network traffic for signs of spoofed packets and adjust TTL settings to prevent packets with insufficient TTL from reaching the internal destination.

Exploit

Fix

Related Identifiers

CVE-2005-3774

Affected Products

Cisco Pix

References · 19

• 🔥 https://exploit-db.com/exploits/26548 · Exploit
• 🔥 https://exploit-db.com/exploits/1338 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-3774 · Security Note
• http://cisco.com/warp/public/707/cisco-response-20051122-pix.shtml · Vendor Advisory
• http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/038971.html · Vendor Advisory
• http://securityfocus.com/bid/15525 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25079 · Note
• http://securityfocus.com/archive/1/426989/100/0/threaded · Note
• http://cisco.com/en/US/products/hw/vpndevc/ps2030/products_security_notice09186a0080624a37.html · Note
• http://kb.cert.org/vuls/id/853540 · Note
• http://securityfocus.com/archive/1/426991/100/0/threaded · Note
• http://securityfocus.com/archive/1/427041/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25077 · Note
• http://securitytracker.com/id?1015256 · Note
• http://secunia.com/advisories/17670 · Note