Datasheet

193
Release Notes for Cisco IOS Release 12.1E on the Catalyst 6500 and Cisco 7600 Supervisor Engine and MSFC
OL-2310-11
Caveats
2. Attacks that use ICMP “fragmentation needed and Don’t Fragment (DF) bit set” messages, also
known as Path Maximum Transmission Unit Discovery (PMTUD) attacks.
3. Attacks that use ICMP “source quench” messages.
Successful attacks may cause connection resets or reduction of throughput in existing connections,
depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are
workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml.
The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security
Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple
vendors whose products are potentially affected. Its posting can be found at:
http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en.
This problem is resolved in Release 12.1(20)E6. (CSCed78149, CSCef44225, CSCef44699,
CSCef60659, CSCsa59600)
• A specifically crafted Transmission Control Protocol (TCP) connection to a telnet or reverse telnet
port of a Cisco device running Internetwork Operating System (IOS) may block further telnet,
reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and in some cases Hypertext Transport
Protocol (HTTP) access to the Cisco device. Telnet, reverse telnet, RSH and SSH sessions
established prior to exploitation are not affected.
All other device services will operate normally. Services such as packet forwarding, routing
protocols and all other communication to and through the device are not affected.
Cisco will make free software available to address this vulnerability. Workarounds, identified below,
are available that protect against this vulnerability.
The Advisory is available at
http://www.cisco.com/warp/public/707/cisco-sa-20040827-telnet.shtml
This problem is resolved in Release 12.1(20)E6. (CSCef46191)
• OSPF area border routers (ABRs) might continue to generate summary link-state advertisements
(LSAs) for obsolete nonbackbone intra-area routes. This problem is resolved in Release 12.1(20)E6.
(CSCee36622)
• When an OSPF external route has a forwarding address with a next hop address in the routing table,
the next hop address does not get updated in the type 5 link-state advertisement (LSA) when the
forwarding address gets a more specific entry in the routing table with a different next hop address.
This problem is resolved in Release 12.1(20)E6. (CSCed59370)
• Ping to the IP address of a local GRE tunnel interface fails. This problem is resolved in
Release 12.1(20)E6. (CSCdx74855)
• Traffic through a port-channel interface that has a Cisco IOS ACL configured might be dropped or
switched in software after a reload or after switchover to a redundant supervisor engine or after you
enter shutdown and no shutdown interface commands on a member port. This problem is resolved
in Release 12.1(20)E6. (CSCee21772)
• SNMP traps are sent for every Internet Key Exchange (IKE) timeout and rekey but not for every
IPsec timeout and rekey. This situation might generate many false alerts that an IKE tunnel is down
when the IKE tunnel is torn down but immediately rebuilt. Releases where CSCee91044 is resolved
do not send SNMP traps that are sent for normal IKE operation. This problem is resolved in
Release 12.1(20)E6. (CSCee91044)