Cisco Gigabit Ethernet Switch Module for HP BladeSystem p-Class Release Notes, Cisco IOS Release 12.2(37)SE and later

Cisco Gigabit Ethernet Switch Module for HP BladeSystem p-Class Release Notes, Cisco IOS Release 12.2(37)SE and Later

383623-009

Resolved Caveats

This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070522-SSL.shtml.

Note Another related advisory has been posted with this advisory. This additional advisory also

describes a vulnerability related to cryptography that affects Cisco IOS. This related advisory is

available at the following link:

http://www.cisco.com/warp/public/707/cisco-sa-20070522-crypto.shtml.

A combined software table for Cisco IOS is available to aid customers in choosing a software

releases that fixes all security vulnerabilities published as of May 22, 2007. This software table is

available at the following link:

http://www.cisco.com/warp/public/707/cisco-sa-20070522-cry-bundle.shtml.

• CSCsb40304

Cisco IOS device may crash while processing malformed Secure Sockets Layer (SSL) packets. In

order to trigger these vulnerabilities, a malicious client must send malformed packets during the SSL

protocol exchange with the vulnerable device.

Successful repeated exploitation of any of these vulnerabilities may lead to a sustained

Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the

confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow

an attacker will not be able to decrypt any previously encrypted information.

Cisco IOS is affected by the following vulnerabilities:

–

Processing ClientHello messages, documented as Cisco bug ID CSCsb12598

–

Processing ChangeCipherSpec messages, documented as Cisco bug ID CSCsb40304

–

Processing Finished messages, documented as Cisco bug ID CSCsd92405

Cisco has made free software available to address these vulnerabilities for affected customers. There

are workarounds available to mitigate the effects of these vulnerabilities.

This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070522-SSL.shtml.

Note Another related advisory has been posted with this advisory. This additional advisory also

describes a vulnerability related to cryptography that affects Cisco IOS. This related advisory is

available at the following link:

http://www.cisco.com/warp/public/707/cisco-sa-20070522-crypto.shtml.

A combined software table for Cisco IOS is available to aid customers in choosing a software

releases that fixes all security vulnerabilities published as of May 22, 2007. This software table is

available at the following link:

http://www.cisco.com/warp/public/707/cisco-sa-20070522-cry-bundle.shtml.

• CSCsc30733

This error message no longer appears during authentication when a method list is used and one of

the methods in the method list is removed:

AAA-3-BADMETHODERROR:Cannot process authentication method 218959117

• CSCsd60718

When you enter the no speed interface configuration command, the Ethernet interface speed now

correctly returns to its default setting. This affects interfaces Gigabit Ethernet 0/17 to Gigabit

Ethernet 0/20, Gigabit Ethernet 0/23, and Gigabit Ethernet 0/24. This does not affect interfaces

Gigabit Ethernet 0/21 and Gigabit Ethernet 0/22.