Fernando Gont has published an Internet-Draft describing how ICMP (Internet Control Message Protocol) can be exploited by malicious people to cause a DoS (Denial of Service). Cisco has acknowledged that various Cisco products are affected.

The published Internet-Draft details three types of attacks, which utilize the following ICMP messages to cause a negative impact on TCP connections either terminating or originating from a vulnerable device.

1) ICMP "hard" error messages
2) ICMP "fragmentation needed and Don't Fragment (DF) bit set" messages (known as PMTUD attacks)
3) ICMP "source quench" messages

These attacks can all be exploited to cause TCP connection resets, reduce the throughput in existing TCP connections, or consume large amounts of CPU and memory resources.

Successful exploitation requires knowledge of IP address information of the source and destination of the TCP network connection..

NOTE: See the original advisory for a list of affected versions.

Solution
See patch matrix in vendor advisory for information about fixes.
Further details available to Secunia VIM customers

Provided and/or discovered by
Fernando Gont

Changelog
Further details available to Secunia VIM customers

Original Advisory
Cisco:
http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml

NISCC:
http://www.niscc.gov.uk/niscc/docs/al-20050412-00308.html

ICMP attacks against TCP:
http://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers