CVE-2000-0613: Medium severity Cisco PIX firewall vulnerability
Cisco Secure PIX Firewall does not properly identify forged TCP Reset (RST) packets, which allows remote attackers to force the firewall to close legitimate connections.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply network-level mitigations to reduce exposure to forged TCP RSTs: restrict which IP ranges may send TCP reset packets to protected hosts by adding ACLs or firewall rules on the PIX or upstream routers, and/or rate-limit or drop unsolicited TCP RST packets from untrusted networks to prevent injection of forged resets.
- Operational
Monitor firewall logs and network traffic for anomalous or frequent TCP RST packets and unexpected connection terminations; capture packet traces for incidents, investigate root cause, and restore or re-establish legitimate connections as needed.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0613?
CVE-2000-0613 has a high severity rating as it allows attackers to disrupt legitimate connections on the Cisco Secure PIX Firewall.
What are the implications of CVE-2000-0613?
The implications of CVE-2000-0613 include potential service disruptions and loss of connectivity for affected users due to forged TCP Reset packets.
How do I fix CVE-2000-0613?
To fix CVE-2000-0613, it is recommended to update to a version of Cisco PIX Firewall that addresses this vulnerability.
Which devices are affected by CVE-2000-0613?
CVE-2000-0613 affects Cisco PIX Firewall devices, including the Cisco PIX 501.
Can CVE-2000-0613 be exploited remotely?
Yes, CVE-2000-0613 can be exploited remotely by attackers who send forged TCP Reset packets.