2/20/2007 -- Another week, another new vulnerability. Make that a round dozen of them.

Cisco Systems Inc. last week confirmed the existence of at least 12 new vulnerabilities across a range of different products and technologies -- including two that affect its IOS stack. In addition, Cisco warned of multiple vulnerabilities in its PIX, ASA and FWSM products.

The IOS flaws (which are native to IOS versions 12.3.x and 12.4.x) actually affect IOS' intrusion prevention system (IPS) capabilities, Cisco officials said.

For the record, Cisco acknowledged both a Fragmented Packet Evasion vulnerability and an ATOMIC.TCP Regular Expression DoS vulnerability.

An attacker can remotely exploit the former flaw without first authenticating or otherwise interacting with IOS, Cisco confirmed; the attack vector involves fragmenting malicious network traffic in such a way so as to evade detection by IPS signatures that depend on regular expressions to identify attacks. The second flaw, too, can be remotely exploited without user interaction. Its attack vector is occasioned by the use of IP traffic that triggers signature 3123.0 -- i.e., NetBus Pro Traffic -- which (in some cases) can cause the IOS IPS device itself to fail. The most effective workaround, Cisco officials said, is to disable signature 3123.0 in the IOS IPS configuration.

Elsewhere, Cisco identified new vulnerabilities in its PIX, ASA and FWSM products, most of which result in DoS -- and at least one of which can result in remote code execution. For the record, Cisco officials acknowledged the existence of 10 new vulnerabilities in its PIX, ASA and FWSM offerings, including:

• A Malformed HTTP Request vulnerability (designated Cisco Bug ID CSCsd75794) that results in DoS. This flaw affects all PIX, ASA and FWSM products. The likely attack vector is TCP port 80 in traffic which transits a device.
• A Malformed Session Initiation Protocol (SIP) messages vulnerability (designated Cisco Bug IDs CSCsg80915, CSCse27708, CSCsd97077) that results in DoS. All PIX, ASA and FWSM products are affected. The likely attack vector -- which involves spoofed packets -- is UDP port 5060.
• A Malformed Auth-Proxy Requests using HTTPS vulnerability (designated Cisco Bug ID CSCsg50228) that results in DoS. Cisco's FWSM product is affected. The likely attack vector is SSL TCP port 443.
• A Long Auth-Proxy Request Vulnerability (designated Cisco Bug ID CSCsd91268) that could result in DoS or remote code execution. Cisco's FWSM product is affected. Likely attack vectors are TCP ports 80 and 443. This vulnerability is configuration related and Cisco declined to provide additional information.
• A Device-Directed Packet Processing DoS vulnerability (designated Cisco Bug ID CSCse85707). Cisco's FWSM product is affected.
• A Device-Directed HTTPS Processing DoS vulnerability (designated Cisco Bug ID CSCsf29974). Cisco's FWSM product is affected. The likely attack vector -- once again -- is TCP port 443 (SSL).
• A Malformed SNMP Request DoS vulnerability (designated Cisco Bug ID CSCse52679). Cisco's FWSM product is affected. The likely attack vector -- which involves spoofed packets -- is UDP port 161.
• A Malformed TCP Packet DoS vulnerability (designated Cisco Bug ID CSCsh12711). Cisco's ASA and PIX Firewall products are affected. The attack vector is an inspected TCP stream, Cisco said.
• A Local Privilege Escalation Vulnerability (designated Cisco Bug ID CSCsh33287). Cisco did not say which platforms are affected.
• An Access Control List (ACL) Corruption vulnerability. Cisco did not say which platforms are affected. This vulnerability is configuration related and Cisco declined to provide additional information.

-- Stephen Swoyer