Secunia

A security issue has been reported in Cisco Firewall Services Module (FWSM), which can result in certain traffic bypassing configured ACLs.

The security issue is caused due to an error as URL, HTTPS, and FTP filtering exceptions configured to exclude certain addresses from being filtered for e.g. outbound connections on the internal interface also causes TCP traffic matching the exception filters from not being filtered on any interface.

Successful exploitation allows TCP traffic to bypass configured ACLs meant to filter them, but requires that FWSM has been configured to allow exceptions for content filtering.

The security issue affects Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Internet Routers with a FWSM installed running version 2.3.1 or prior.

Solution
Update to version 2.3(2).
Further details available in Customer Area

Provided and/or discovered by
Reported by vendor.

Changelog
Further details available in Customer Area

Original Advisory
http://www.cisco.com/warp/public/707/cisco-sa-20050511-url.shtml

Deep Links
Links available in Customer Area