----------------------------------------------------------------------

Want a new IT Security job?

Vacant positions at Secunia:
http://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
Cisco Firewall Services Module TCP Packet URL Filtering Bypass

SECUNIA ADVISORY ID:
SA15349

VERIFY ADVISORY:
http://secunia.com/advisories/15349/

CRITICAL:
Less critical

IMPACT:
Security Bypass

WHERE:
>From remote

SOFTWARE:
Cisco Firewall Services Module (FWSM) 1.x
http://secunia.com/product/2273/
Cisco Firewall Services Module (FWSM) 2.x
http://secunia.com/product/5088/

DESCRIPTION:
A security issue has been reported in Cisco Firewall Services Module
(FWSM), which can result in certain traffic bypassing configured
ACLs.

The security issue is caused due to an error as URL, HTTPS, and FTP
filtering exceptions configured to exclude certain addresses from
being filtered for e.g. outbound connections on the internal
interface also causes TCP traffic matching the exception filters from
not being filtered on any interface.

Successful exploitation allows TCP traffic to bypass configured ACLs
meant to filter them, but requires that FWSM has been configured to
allow exceptions for content filtering.

The security issue affects Cisco Catalyst 6500 Series Switches and
Cisco 7600 Series Internet Routers with a FWSM installed running
version 2.3.1 or prior.

SOLUTION:
Update to version 2.3(2).

The security issue has also been addressed in interim images 2.2(1)18
and 1.1(4)4.

PROVIDED AND/OR DISCOVERED BY:
Reported by vendor.

ORIGINAL ADVISORY:
http://www.cisco.com/warp/public/707/cisco-sa-20050511-url.shtml

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------