Several reported vulnerabilities in Cisco Systems Inc.'s products can be exploited to cause denial-of-service conditions...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
on active Transmission Control Protocol (TCP) sessions.
The product flaws, confirmed in an update released by Cisco and classified as low risk in a Secunia advisory posted this morning, include:
Cisco Aironet 1200 Series Access Point
Cisco Aironet 350 Series Access Point
Cisco Content Services Switch 11000 Series (WebNS)
Cisco MGX 8200 Series Edge Concentrators
Cisco MGX 8800 Series Multiservice Switches
Cisco MGX 8900 Series Multiservice Switches
Cisco SN5400 Series Storage Routers
The vulnerability is caused due to a TCP timestamp option error. The flaws allow a remote user to send a packet with specially crafted TCP timestamp options, ultimately causing a target TCP connection to stall until the TCP connection is reset.
The advisory said knowledge of IP address information of the source and destination of the TCP network connection is required for successful exploitation.
Only systems running VxWorks, a real-time operating system for embedded software and process control applications, are affected.
Systems running VxWorks can be upgraded to Cisco IOS to address this issue; access points running Cisco IOS are not affected.
The Cisco advisory recommends that users apply vendor-provided patches.