-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Security Advisory: Denial-of-Service of TCP-based Services in CatOS

Revision 1.0

For Public Release 2003 July 09 at 16:00 UTC (GMT)

- -------------------------------------------------------------------------

Summary
======
After receiving eight TCP connection attempts using a non-standard TCP
flags combination, a Catalyst switch will stop responding to further TCP
connections to that particular service. In order to re-establish
functionality of that service, the switch must be rebooted. There is no
workaround. This vulnerability affects only CatOS. No other Cisco
products are affected.

This advisory is available at 
http://www.cisco.com/warp/public/707/cisco-sa-20030709-swtcp.shtml.

Affected Products
=================
The CatOS for the following Catalyst models are affected:

  * Catalyst 4000 Series including models 2948G and 2980G/2980G-A
   
  * Catalyst 5000 Series including models 2901, 2902 and 2926
   
  * Catalyst 6000
   
No other Cisco products are affected.

Details
=======
After receiving eight connection attempts on any TCP service, the switch
will stop responding to any further connection attempts to that service.
These attempts must use a non-standard combination of TCP flags. The
switch will continue to pass other switched traffic normally and the
console is also not affected. Only the service to which connections were
made will become unresponsive. Standard TCP services include HTTP,
Telnet, and SSH.

This vulnerability is documented as Cisco Bug ID CSCdw52219 (registered
customers only) .

Impact
======
By exploiting this vulnerability, an attacker can prevent further use of
the specified TCP-based service. Depending on the configuration of the
device, if SSH or Telnet are enabled and exploited, the availability of
those services could be affected, possibly resulting in a loss of
management capability using those same services. However, UDP-based
services such as Simple Network Management Protocol (SNMP) would still be
available and unaffected.

Software Versions and Fixes
===========================
The vulnerability is fixed in the following releases.

+-------------------------------------------------------+
|       | Description |                                 |
| Train | of Image or | Availability of Fixed Releases* |
|       |  Platform   |                                 |
|-------+-------------+---------------------------------|
|       |             | Rebuild | Interim | Maintenance |
|       |             |         | **      |             |
|-------+-------------+---------+---------+-------------|
|       | Catalyst    |         | 5.5     |             |
| 5.5   | 4000, 5000, |         | (13.5)  | 5.5(14)     |
|       | 6000        |         |         |             |
|-------+-------------+---------+---------+-------------|
|       | Catalyst    |         | 6.3     |             |
| 6.3   | 4000, 5000, |         | (5.10)  | 6.3(6)      |
|       | 6000        |         |         |             |
|-------+-------------+---------------------------------|
|       | Catalyst    |                                 |
| 6.4   | 4000, 5000, | Not affected                    |
|       | 6000        |                                 |
|-------+-------------+---------------------------------|
| 7.2   | Catalyst    |         | 7.2     | 7.2(1)      |
|       | 4000, 6000  |         | (0.65)  |             |
|-------+-------------+---------+---------+-------------|
|       | Catalyst    |         | 7.4     |             |
| 7.4   | 4000, 6000  |         | (0.2)   | 7.4(1)      |
|       |             |         | CLR     |             |
|-------+-------------+---------------------------------|
| 8.1   | Catalyst    | Not affected                    |
|       | 6000        |                                 |
+-------------------------------------------------------+

* All dates are estimates and subject to change.

** Interim releases are subjected to less rigorous testing than regular
maintenance releases, and may have serious bugs.

Obtaining Fixed Software
========================
Cisco is offering free software upgrades to address these vulnerabilities
for all affected customers. Customers may only install and expect support
for the feature sets they have purchased. By installing, downloading,
accessing or otherwise using such software upgrades, Customers agree to
be bound by the terms of Cisco software license terms found at 
http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set
forth at the Cisco Connection Online Software Center at 
http://www.cisco.com/public/sw-center/sw-usingswc.shtml.

Customers with service contracts should contact their regular update
channels to obtain the free software upgrade identified via this
advisory. For most customers with service contracts, this means that
upgrades should be obtained through the Software Center on the Cisco
worldwide website at http://www.cisco.com/tacpage/sw-center/sw-lan.shtml.
To access the software download URL, you must be a registered user and
you must be logged in.

Customers whose Cisco products are provided or maintained through prior
or existing agreement with third-party support organizations such as
Cisco Partners, authorized resellers, or service providers should contact
that support organization for assistance with the upgrade, which should
be free of charge.

Customers who purchase direct from Cisco but who do not hold a Cisco
service contract and customers who purchase through third-party vendors
but are unsuccessful at obtaining fixed software through their point of
sale should get their upgrades by contacting the Cisco Technical
Assistance Center (TAC). TAC contacts are as follows.

  * +1 800 553 2447 (toll free from within North America)
   
  * +1 408 526 7209 (toll call from anywhere in the world)
   
  * e-mail: tac@cisco.com
   
Please have your product serial number available and give the URL of this
notice as evidence of your entitlement to a free upgrade. Free upgrades
for non-contract customers must be requested through the TAC.

Please do not contact either "psirt@cisco.com" or
"security-alert@cisco.com" for software upgrades.

Workarounds
===========
There is no workaround. In order to continue using an affected TCP
service, the switch must be rebooted.

It is possible to mitigate the exposure by configuring VLAN Access
Control Lists (VACLs) on the switch (where they are supported) that will
allow only legitimate hosts to connect to the desired services. This must
be combined with Unicast Reverse Path Forwarding (uRPF), or some other
anti-spoofing technique, on the network edge to protect against spoofed
packets from the outside of the network.

Exploitation and Public Announcements
=====================================
This vulnerability has been reported to Cisco by a customer. The Cisco
PSIRT has received no reports of malicious exploitation of this
vulnerability and we are not aware of any public discussion.

Status of This Notice: FINAL
============================
This is a final advisory. Although Cisco cannot guarantee the accuracy of
all statements in this advisory, all of the facts have been checked to
the best of our ability. Cisco does not anticipate issuing updated
versions of this advisory unless there is some material change in the
facts. Should there be a significant change in the facts, Cisco will
update this advisory.

A stand-alone copy or paraphrase of the text of this security advisory
that omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain factual
errors.

Distribution
============
This advisory will be posted on the Cisco Worldwide Web site at 
http://www.cisco.com/warp/public/707/cisco-sa-20030709-swtcp.shtml.

In addition to Worldwide Web posting, a text version of this notice is
clear-signed with the Cisco PSIRT PGP key and is posted to the following
e-mail and Usenet news recipients.

    * cust-security-announce@cisco.com

    * bugtraq@securityfocus.com

    * full-disclosure@lists.netsys.com

    * first-teams@first.org (includes CERT/CC)

    * cisco@spot.colorado.edu

    * cisco-nsp@puck.nether.net

    * comp.dcom.sys.cisco

    * Various internal Cisco mailing lists

Future updates of this advisory, if any, will be placed on the Cisco
Worldwide Web server, but may or may not be actively announced on mailing
lists or newsgroups. Users concerned about this problem are encouraged to
check the URL given above for any updates.

Revision History
================
+-----------------------------------------+
| Revision | 2003-July-09   | Initial     |
| 1.0      | 16:00 UTC      | public      |
|          | (GMT)          | release     |
+-----------------------------------------+

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and registering
to receive security information from Cisco, is available on the Cisco
Worldwide Web site at 
http://www.cisco.com/warp/public/707/sec_incident_response.shtml. 
This includes instructions for press inquiries regarding Cisco
security notices.

All Cisco Security Advisories are available at 
http://www.cisco.com/go/psirt.

- -------------------------------------------------------------------------

This notice is Copyright 2003 by Cisco Systems, Inc. This notice may be
redistributed freely after the release date given at the top of the text,
provided that redistributed copies are complete and unmodified, and
include all date and version information.

- -------------------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (MingW32)

iD8DBQE/DD4aezGozzK2tZARAmavAKD3A+uXp53Qc4doMl63moeltYNJAgCeKYpK
rkRl8y9fVCoj1O8CtYXiG9A=
=BxRP
-----END PGP SIGNATURE-----