Cisco Firewall Services Module Skinny Client Control Protocol Inspection Denial of Service Vulnerability
15 Jun. 2011
Summary
A vulnerability exists in the Cisco Firewall Services Module that may cause the Cisco FWSM to reload after processing a malformed Skinny Client Control Protocol message.
Vulnerable Systems:
* Cisco Firewall Services Module for Cisco Catalyst 6500 Series Switches
* Cisco Firewall Services Module for Cisco 7600 Series Routers
Immune Systems:
* Cisco ASA 5500 Series Adaptive Security Appliances
The Cisco FWSM is affected by a vulnerability that may cause the device to reload during the processing of a malformed SCCP message when SCCP inspection is enabled.
This vulnerability is triggered only by transit traffic; traffic that is destined to the device does not trigger this vulnerability.
Workaround:
If SCCP inspection is not required, it can be disabled so the device is no longer affected by the vulnerability. Administrators can disable SCCP inspection by issuing the no inspect skinny command in class configuration submode in the policy map configuration. If SCCP inspection is required, there are no workarounds.
