Release Notes

21
Release Notes for Cisco PDSN Release 5.2 in IOS Release 12.4(22)XR7
OL-23372-01
Caveats
• CSCtf17624
The Cisco IOS Software Network Address Translation functionality contains three denial of service
(DoS) vulnerabilities. The first vulnerability is in the translation of Session Initiation Protocol (SIP)
packets, the second vulnerability in the translation of H.323 packets and the third vulnerability is in
the translation of H.225.0 call signaling for H.323 packets.
Cisco has released free software updates that address these vulnerabilities.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20100922-nat.shtml.
Note: The September 22, 2010, Cisco IOS Software Security Advisory bundled publication includes
six Cisco Security Advisories. Five of the advisories address vulnerabilities in Cisco IOS Software,
and one advisory addresses vulnerabilities in Cisco Unified Communications Manager. Each
advisory lists the releases that correct the vulnerability or vulnerabilities detailed in the advisory.
The table at the following URL lists releases that correct all Cisco IOS Software vulnerabilities that
have been published on September 22, 2010, or earlier:
http://www.cisco.com/warp/public/707/cisco-sa-20100922-bundle.shtml
Individual publication links are in “Cisco Event Response: Semiannual Cisco IOS Software Security
Advisory Bundled Publication” at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep10.html
• CSCtf91428
The Cisco IOS Software Network Address Translation functionality contains three denial of service
(DoS) vulnerabilities. The first vulnerability is in the translation of Session Initiation Protocol (SIP)
packets, the second vulnerability in the translation of H.323 packets and the third vulnerability is in
the translation of H.225.0 call signaling for H.323 packets.
Cisco has released free software updates that address these vulnerabilities.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20100922-nat.shtml.
Note: The September 22, 2010, Cisco IOS Software Security Advisory bundled publication includes
six Cisco Security Advisories. Five of the advisories address vulnerabilities in Cisco IOS Software,
and one advisory addresses vulnerabilities in Cisco Unified Communications Manager. Each
advisory lists the releases that correct the vulnerability or vulnerabilities detailed in the advisory.
The table at the following URL lists releases that correct all Cisco IOS Software vulnerabilities that
have been published on September 22, 2010, or earlier:
http://www.cisco.com/warp/public/707/cisco-sa-20100922-bundle.shtml
Individual publication links are in “Cisco Event Response: Semiannual Cisco IOS Software Security
Advisory Bundled Publication” at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep10.html
• CSCsz43987
Multiple vulnerabilities exist in the Session Initiation Protocol (SIP) implementation in Cisco IOS
Software that could allow an unauthenticated, remote attacker to cause a reload of an affected device
when SIP operation is enabled.
Cisco has released free software updates that address these vulnerabilities. There are no
workarounds for devices that must run SIP; however, mitigations are available to limit exposure to
the vulnerabilities.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20100922-sip.shtml.
Note: The September 22, 2010, Cisco IOS Software Security Advisory bundled publication includes
six Cisco Security Advisories. Five of the advisories address vulnerabilities in Cisco IOS Software,
and one advisory addresses vulnerabilities in Cisco Unified Communications Manager. Each