A security issue has been reported in Cisco Firewall Services Module (FWSM), which can result in certain traffic bypassing configured ACLs.
The security issue is caused due to an error as URL, HTTPS, and FTP filtering exceptions configured to exclude certain addresses from being filtered for e.g. outbound connections on the internal interface also causes TCP traffic matching the exception filters from not being filtered on any interface.
Successful exploitation allows TCP traffic to bypass configured ACLs meant to filter them, but requires that FWSM has been configured to allow exceptions for content filtering.
The security issue affects Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Internet Routers with a FWSM installed running version 2.3.1 or prior.
SOFTWARE:
Cisco Firewall Services Module (FWSM) 1.x
Cisco Firewall Services Module (FWSM) 2.x
SOLUTION:
Update to version 2.3(2).
The security issue has also been addressed in interim images 2.2(1)18
and 1.1(4)4.
PROVIDED AND/OR DISCOVERED BY:
Reported by vendor.
ORIGINAL ADVISORY:
http://www.cisco.com/warp/public/707/cisco-sa-20050511-url.shtml
VERIFY ADVISORY:
http://secunia.com/advisories/15349/
Secunia Security Advisories
http://community.securityteam.us/article.php/20050516101220915