5/14/2007 -- It's been a rough stretch for Cisco Systems Inc.'s PIX and ASA appliances. Earlier this month, Cisco alerted users to the existence of multiple LDAP and denial-of-service (DoS) vulnerabilities in both products.

Then, in a follow-up to a bulletin published by US-CERT, Cisco acknowledged the existence of another PIX and ASA vulnerability -- this time, a DHCP Relay Agent flaw that could lead to DoS.

The vulnerability affects PIX and ASA system software versions 7.2(1) through 7.2(2.14) only. In cases where PIX and ASA appliances have been configured to act as DHCP relays, the DHCPACK messages that it receives from DHCP servers (typically in response to DHCPREQUEST or DHCPINFORM traffic from clients) may cause the 1550 byte block memory to be consumed. Both devices use 1550 byte block memory to store Ethernet packets for processing.

When the available 1550 byte block memory is finally exhausted, the appliance will stop forwarding packets, Cisco said.

The vulnerability affects only devices configured as DHCP relays for multiple DHCP servers; devices configured to relay to only a single DHCP server are not vulnerable, Cisco confirmed.

Cisco provided system software fixes to patch both its PIX and ASA appliances. --Stephen Swoyer