Cisco Gigabit Ethernet Switch Module for HP BladeSystem p-Class Release Notes, Cisco IOS Release 12.2(35)SE and later

383623-007

Resolved Caveats

This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070522-SSL.shtml.

Note Another related advisory has been posted with this advisory. This additional advisory also

describes a vulnerability related to cryptography that affects Cisco IOS. This related advisory is

available at the following link:

http://www.cisco.com/warp/public/707/cisco-sa-20070522-crypto.shtml.

A combined software table for Cisco IOS is available to aid customers in choosing a software

releases that fixes all security vulnerabilities published as of May 22, 2007. This software table is

available at the following link:

http://www.cisco.com/warp/public/707/cisco-sa-20070522-cry-bundle.shtml.

• CSCsb56438

An extra index no longer appears in the port table of the ciscoStpExtensions MIB.

• CSCsb75245

When you configure a Cisco IP Phone to use Network Admission Control, the CDP packet is no

longer delayed, and the phone is no longer identified as an agentless host without an identity profile.

• CSCsb74648

When a Cisco device is configured for Network Admission Control and the EAP over UDP port

number changes from its default value and then changes back with the eou default switch

configuration command, the port change now takes effect.

• CSCsc05371

When you configure a MAC address filter by entering the mac-address-table static vlan drop

global configuration command, IEEE 802.1X no longer authenticates supplicants using that address.

If a supplicant with that address is authenticated, its authorization is revoked.

• CSCsc26726

The interfaces GigabitEthernet0/23 and 0/24 now link to another switch or host when the interface

speed is set to an explicit value or auto-MDIX is disabled.

• CSCsc29225

When you remove the bridge topology change trap with the no snmp-server enable traps bridge

topologychange configuration command, the stpx root-inconsistency trap is now active.

• CSCsd78044

When IGMP snooping is enabled and an EtherChannel member interface goes down, the switch now

forwards multicast traffic on the rest of the EhternetChannel member interfaces.

• CSCsc83583

When you enter the show interfaces transceiver properties privileged EXEC command for a Gigabit

Ethernet dual-media interface and the interface is set to media-type rj45, the output now shows the

correct attached SFP module. This only applies to GigabitEthernet0/17 to 0/20.

• CSCsd85587

A vulnerability has been discovered in a third party cryptographic library which is used by a number

of Cisco products. This vulnerability may be triggered when a malformed Abstract Syntax Notation

One (ASN.1) object is parsed. Due to the nature of the vulnerability it may be possible, in some

cases, to trigger this vulnerability without a valid certificate or valid application-layer credentials

(such as a valid username or password).