https://community.cisco.com/t5/network-security/system-vulnerability-through-pix/m-p/936896#M917042 <P>The following vulnerability is showing up on systems when scanned through our PIX firewall(with all ICMP except echo-replies blocked).</P><P></P><P><A class="jive-link-custom" href="http://www.iss.net/security_center/reference/vuln/icmp-nofragment-lowmtu-dos.htm" target="_blank">http://www.iss.net/security_center/reference/vuln/icmp-nofragment-lowmtu-dos.htm</A></P><P></P><P>Can anyone explain why this would happen? The firewall should mitigate all vulnerabilities of this type since ICMP is blocked...</P> Mon, 11 Mar 2019 13:11:54 GMT zztopping 2019-03-11T13:11:54Z https://community.cisco.com/t5/network-security/system-vulnerability-through-pix/m-p/936896#M917042 <P>The following vulnerability is showing up on systems when scanned through our PIX firewall(with all ICMP except echo-replies blocked).</P><P></P><P><A class="jive-link-custom" href="http://www.iss.net/security_center/reference/vuln/icmp-nofragment-lowmtu-dos.htm" target="_blank">http://www.iss.net/security_center/reference/vuln/icmp-nofragment-lowmtu-dos.htm</A></P><P></P><P>Can anyone explain why this would happen? The firewall should mitigate all vulnerabilities of this type since ICMP is blocked...</P> Mon, 11 Mar 2019 13:11:54 GMT https://community.cisco.com/t5/network-security/system-vulnerability-through-pix/m-p/936896#M917042 zztopping 2019-03-11T13:11:54Z https://community.cisco.com/t5/network-security/system-vulnerability-through-pix/m-p/936897#M917043 <HTML><HEAD></HEAD><BODY><P>Hi Jonathan,</P><P></P><P>Your PIX is only vulnerable if you are running 6.3 code or earlier and have IPsec enabled (which is not enabled by default). The vulnerability is due to CSCef57566. Also, I would recommend taking a look at the follow link, which has all the details of this vulnerability:</P><P><A class="jive-link-custom" href="http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml" target="_blank">http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml</A></P><P></P><P>As a workaround, you can disable IPSec, though this is probably not a viable solution for you. Therefore, to be protected against this vulnerability, you should upgrade to the latest 6.3.5.x interim release, or move to the 7.x or 8.x trains where this vulnerability does not exist.</P><P></P><P>Hope that helps.</P><P></P><P>-Mike</P></BODY></HTML> Sat, 16 Aug 2008 01:24:11 GMT https://community.cisco.com/t5/network-security/system-vulnerability-through-pix/m-p/936897#M917043 robertson.michael 2008-08-16T01:24:11Z