Cisco Firewall Services Module SCCP Inspection DoS Vulnerability
9 Apr. 2010
Summary
A vulnerability exists in the Cisco Firewall Services Module (FWSM) for the Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers that may cause the Cisco FWSM to reload after processing a malformed Skinny Client Control Protocol (SCCP) message.
Vulnerable Systems:
Cisco FWSM 4.X with SCCP inspection enabled
Cisco ASA 5500 Series Adaptive Security Appliances
The Cisco FWSM is affected by a vulnerability that may cause the device to reload during the processing of a malformed SCCP message when SCCP inspection is enabled. This vulnerability is only triggered by transit traffic; traffic that is destined to the device does not trigger this vulnerability.
This issue is documented in Cisco bug ID CSCtb60485.
Patch Availability:
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
Fixed Cisco FWSM Software can be downloaded from the Software Center on Cisco.com by visiting http://www.cisco.com/cisco/web/download/index.html
and navigating to "Security > Cisco Catalyst 6500 Series Firewall Services Module > Firewall Services Module (FWSM) Software".
Workaround:
If SCCP inspection is not required, this vulnerability can be mitigated by disabling it. Administrators can disable SCCP inspection by issuing the "no inspect skinny" command in class configuration sub-mode within the policy map configuration. If SCCP inspection is required, there are no workarounds.
