System Vulnerability through PIX

[zztopping]

The following vulnerability is showing up on systems when scanned through our PIX firewall(with all ICMP except echo-replies blocked).

http://www.iss.net/security_center/reference/vuln/icmp-nofragment-lowmtu-dos.htm

Can anyone explain why this would happen? The firewall should mitigate all vulnerabilities of this type since ICMP is blocked...

[robertson.michael]

Hi Jonathan,

Your PIX is only vulnerable if you are running 6.3 code or earlier and have IPsec enabled (which is not enabled by default). The vulnerability is due to CSCef57566. Also, I would recommend taking a look at the follow link, which has all the details of this vulnerability:

http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml

As a workaround, you can disable IPSec, though this is probably not a viable solution for you. Therefore, to be protected against this vulnerability, you should upgrade to the latest 6.3.5.x interim release, or move to the 7.x or 8.x trains where this vulnerability does not exist.

Hope that helps.

-Mike