Cisco PIX Firewall SMTP Content Filtering Evasion Vulnerability

Solution:
Cisco as of 09/27/00 released an advisory on this vulnerability titled "Cisco Secure PIX Firewall Mailguard Vulnerability
" this advisory is listed in it's entirety withint the 'Credit' section of this vulnerability entry. The fix information provided in that advisory is as follows:

Getting Fixed Software

Cisco is offering free software upgrades to remedy this vulnerability
for all affected customers. Customers with service contracts may
upgrade to any software version. Customers without contracts may
upgrade only within a single row of the table below, except that any
available fixed software will be provided to any customer who can use
it and for whom the standard fixed software is not yet available. As
always, customers may install only the feature sets they have
purchased.

+-------------------------------------+----------------------------------+
| | Fixed Regular Release available |
| Version Affected | now; fix will carry forward into |
| | all later releases |
+-------------------------------------+----------------------------------+
| All versions of Cisco Secure PIX up | |
| to version 4.4(5) (including 2.7, | 4.4(6) |
| 3.0, 3.1, 4.0, 4.1) | |
+-------------------------------------+----------------------------------+
| Version 5.0.x up to and including | |
| version 5.0(3) | 5.1(3) |
+-------------------------------------+----------------------------------+
| All 5.1.x up to and including | |
| version 5.1(2)* | 5.1(3) |
+-------------------------------------+----------------------------------+
| Version 5.2(1) | 5.2(2) |
+-------------------------------------+----------------------------------+

*For customers who may have engineering releases addressing specific
unrelated defects, designated as 5.1(2)2xx, version 5.1(3) only
includes the SMTP security fixes and does not include any other
bugfixes. Customers requiring engineering releases to address specific
unrelated defects will need to use 5.1(2)207 or higher, which also
includes the SMTP security fixes.

Customers with contracts should obtain upgraded software through their
regular update channels. For most customers, this means that upgrades
should be obtained via the Software Center on Cisco's Worldwide Web
site at http://www.cisco.com.

Customers without contracts should get their upgrades by contacting
the Cisco Technical Assistance Center (TAC). TAC contacts are as
follows:
* +1 800 553 2447 (toll-free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com

Give the URL of this notice as evidence of your entitlement to a free
upgrade. Free upgrades for non-contract customers must be requested
through the TAC. Please do not contact either "psirt@cisco.com" or
"security-alert@cisco.com" for software upgrades.

Exploitation and Public Announcements

This vulnerability was first reported to Cisco by a customer. This
vulnerability has been discussed on public forums.



 

Privacy Statement
Copyright 2010, SecurityFocus