Table Of Contents
Release Notes for the Cisco VG224 Analog Gateway for Cisco IOS Release 12.3(4)XD
Determining Your Software Release
Upgrading to a New Software Release
Determining Which Software Images (Feature Sets) Support a Specific Feature
Determining Which Features Are Supported in a Specific Software Image (Feature Set)
New Hardware and Software Features in Release 12.3(4)XD3 to Release 12.3(4)XD4
New Hardware and Software Features in Release 12.3(4)XD1 to Release 12.3(4)XD3
New Hardware Features in Release 12.3(4)XD
Cisco VG224 24-Port Analog Phone Gateway
New Software Features in Release 12.3(4)XD
Cisco VG224 24 Port Analog Phone Gateway
Open Caveats—Cisco IOS Release 12.3(4)XD4
Resolved Caveats—Cisco IOS Release 12.3(4)XD4
Caveat Advisories - Resolved Caveats
Open Caveats—Cisco IOS Release 12.3(4)XD3
Resolved Caveats—Cisco IOS Release 12.3(4)XD3
Open Caveats—Cisco IOS Release 12.3(4)XD2
Resolved Caveats—Cisco IOS Release 12.3(4)XD2
Open Caveats—Cisco IOS Release 12.3(4)XD1
Resolved Caveats—Cisco IOS Release 12.3(4)XD1
Open Caveats—Cisco IOS Release 12.3(4)XD
Resolved Caveats—Cisco IOS Release 12.3(4)XD
Release Notes for the Cisco VG224 Analog Gateway for Cisco IOS Release 12.3(4)XD
April 12, 2005
Cisco IOS Release 12.3(4)XD4
OL-5153-01 Rev. C0
These release notes for the Cisco VG224 analog gateway describe the product-related enhancements provided in Cisco IOS Release 12.3(4)XD4. These release notes are updated as needed.
For a list of the software caveats that apply to Cisco IOS Release 12.3(4)XD4, see "Caveats" section. See also Caveats for Cisco IOS Release 12.3 T, which is updated for every maintenance release and is located on Cisco.com and the Documentation CD-ROM.
Use these release notes with Cross-Platform Release Notes for Cisco IOS Release 12.3 T located on Cisco.com and the Documentation CD-ROM.
Cisco recommends that you view the field notices for this release to see if your software or hardware platforms are affected. If you have an account on Cisco.com, you can find field notices at http://www.cisco.com/warp/customer/tech_tips/index/fn.html. If you do not have a Cisco.com login account, you can find field notices at http://www.cisco.com/warp/public/tech_tips/index/fn.html.
Contents
These release notes describe the following topics:
Inheritance Information
Cisco IOS Release 12.3(4)XD4, an early deployment release, is based on Cisco IOS Release 12.3(4)T, which in turn is based on Cisco IOS Release 12.3. Cisco IOS Release 12.3(4)T is the first early deployment maintenance release of Cisco IOS Release 12.3 T and is based on the mainline Cisco IOS Release 12.3. Refer to Table 1 for more information.
All features in Cisco IOS Release 12.3(4)T are in Cisco IOS Release 12.3(4)XD4.
Table 1 References for the Cross-Platform Release Notes for Cisco IOS Release 12.3 T and Cisco IOS Release 12.3(4)T
•
Determining the Software Version
•
To view information about the topics in the left-hand column, click Cross-Platform System Requirements at: http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123relnt/xprn123/123reqs.htm
•
•
•
To view information about the topics in the left-hand column for Cisco IOS Release 12.3 T, go to:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123relnt/xprn123/123newf.htm
Scroll down and click New Software Features in Cisco IOS Release 12.3(4)T, or MIBs, or Important Notes.
•
•
•
To view information about the topics in the left-hand column, go to:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123relnt/xprn123/123docs.htm
Introduction
Cisco IOS Release 12.3(4)XD4 supports the Cisco VG224 analog gateway.
The Cisco VG224 series is a family of analog gateways. The Cisco VG224 has 24-port FXS through an RJ-21 connector and two 10/100BaseT interfaces.
For information on new features and Cisco IOS commands supported by Cisco IOS Release 12.3(4)XD4, see "New and Changed Information" section.
Early Deployment Releases
These release notes describe Cisco IOS Release 12.3(4)XD4 for the Cisco VG224 analog gateway. Cisco IOS Release 12.3(4)XD4 is an early deployment (ED) release based on Release 12.3(4)T, which in turn is based on Cisco IOS Release 12.3. Early deployment releases contain fixes to software caveats as well as support for new Cisco hardware and software features. Feature support is cumulative from release to release, unless otherwise noted.
Table 2 lists new features supported by the Cisco VG224 analog gateway in Cisco IOS Release 12.3(4)XD4. See "Inheritance Information" section for a list of the documentation specific to the Cisco VG224 analog gateway.
1 Only major features are listed.
2 MIB = Management Information Base
System Requirements
This section describes the system requirements for Cisco IOS Release 12.3(4)XD4 and includes the following sections:
•
•
Memory Recommendations
Table 3 lists the memory recommendations of the Cisco IOS feature sets for the Cisco VG224 analog gateway for Cisco IOS Release 12.3(4)XD4.
The Cisco VG224 analog gateway is available with a 32-MB Flash memory card.
Supported Hardware
Cisco IOS Release 12.3(4)XD4 supports the following platforms:
•
For detailed descriptions of the new hardware features, see the "New and Changed Information" section.
For information about supported hardware for this platform and release, refer to the Hardware/Software Compatibility Matrix in the Cisco Software Advisor at the following location:
http://www.cisco.com/cgi-bin/front.x/Support/HWSWmatrix/hwswmatrix.cgi
Determining Your Software Release
To determine the version of Cisco IOS software running on the Cisco VG224 analog gateway, log in to the gateway and enter the show version EXEC command:
Router> show versionCisco IOS Software, vg224 Software (vg224-I6K9S-M), Version12.3(4)XD, RELEASE SOFTWARE (fc1)TAC Support: http://www.cisco.com/tacCopyright (c) 1986-2003 by Cisco Systems, Inc.Upgrading to a New Software Release
For general information about upgrading to a new software release, see Cisco IOS Upgrade Ordering Instructions located at: http://www.cisco.com/warp/public/cc/pd/iosw/prodlit/957_pp.htm.
Feature Support
Cisco IOS software is packaged in feature sets that consist of software images that support specific platforms. The feature sets available for a specific platform depend on which Cisco IOS software images are included in a release. Each feature set contains a specific set of Cisco IOS features.
To improve the usability of the release notes documentation, Cisco IOS Release 12.3(4)XD release notes no longer contains the feature set tables. The feature-to-image mapping that was provided by the feature set tables is available through Cisco Feature Navigator.
Cisco Feature Navigator is a web-based tool that enables you to determine which Cisco IOS software images support a specific set of features and which features are supported in a specific Cisco IOS image. You can search by feature or by feature set (software image). Under the release section, you can compare Cisco IOS software releases side by side to display both the features unique to each software release and the features that the releases have in common.
To access Cisco Feature Navigator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions found at this URL:
Cisco Feature Navigator is updated regularly when major Cisco IOS software releases and technology releases occur. For the most current information, go to the Cisco Feature Navigator home page at the following URL:
http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp
For frequently asked questions about Cisco Feature Navigator, see the FAQs at the following URL:
http://www.cisco.com/support/FeatureNav/FNFAQ.html
Caution
Determining Which Software Images (Feature Sets) Support a Specific Feature
To determine which software images (feature sets) in Cisco IOS Release 12.3(4)XD4 support a specific feature, go to the Cisco Feature Navigator home page, enter your Cisco.com login, and perform the following steps:
Step 1
Step 2
Step 3
Note
Repeat this step to add additional features. You can choose a maximum of 20 features for a single search.
Step 4
Step 5
Step 6
Step 7
Determining Which Features Are Supported in a Specific Software Image (Feature Set)
To determine which features are supported in a specific software image (feature set) in Cisco IOS Release 12.3(4)XD4, go to the Cisco Feature Navigator home page, enter your Cisco.com login, and perform the following steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
New and Changed Information
The following sections list the new hardware products and software features supported by the Cisco VG224 analog gateway in Cisco IOS Release 12.3(4)XD4.
New Hardware and Software Features in Release 12.3(4)XD3 to Release 12.3(4)XD4
No new hardware products or software features are supported in Cisco IOS Release 12.3(4)XD3 to Release 12.3(4)XD4.
New Hardware and Software Features in Release 12.3(4)XD1 to Release 12.3(4)XD3
No new hardware products or software features are supported in Cisco IOS Release 12.3(4)XD1 to Release 12.3(4)XD3.
New Hardware Features in Release 12.3(4)XD
The following new hardware product is supported in Cisco IOS Release 12.3(4)XD:
Cisco VG224 24-Port Analog Phone Gateway
Cisco VG224 is a 24-port analog phone gateway based on Cisco IOS software. The platform has 24-port FXS through an RJ-21 connector and two 10/100BaseT interfaces. Cisco VG224 is supported on CCM Release 3.2 or later.
New Software Features in Release 12.3(4)XD
The following new software feature is supported by the Cisco VG224 analog gateway in Cisco IOS Release 12.3(4)XD:
•
Cisco VG224 24 Port Analog Phone Gateway
Cisco VG224 is a 24-port analog phone gateway based on Cisco IOS software. Cisco VG224 enables a hybrid of using VoIP Technology (AVVID based architectures with Cisco Call Manager as call control) with TDM analog endpoints (analog phones, fax machines, analog modems). Cisco VG224 is supported on CCM Release 3.2 or later.
Limitations and Restrictions
Refer to each feature for individual limitations and restrictions.
Current MIBs
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:
http://tools.cisco.com/ITDIT/MIBS/servlet/index
If Cisco MIB Locator does not support the MIB information that you need, you can also obtain a list of supported MIBs and download MIBs from the Cisco MIBs page at the following URL:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
To access Cisco MIB Locator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions found at this URL:
Supported MIBs
To obtain lists of supported MIBs by platform and Cisco IOS release, and to download MIB modules, go to the Cisco MIB website on Cisco.com at:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml.
Field Notices and Bulletins
•
•
•
Caveats
Caveats describe unexpected behavior in Cisco IOS software releases. Severity 1 caveats are the most serious caveats; severity 2 caveats are less serious. Severity 3 caveats are moderate caveats, and only selected severity 3 caveats are included in the caveats document.
This section contains open and resolved caveats for the current Cisco IOS maintenance release.
All caveats in Cisco IOS Release 12.3 and Cisco IOS Release 12.3 T are also in Cisco IOS Release 12.3(4)XD4.
For information on caveats in Cisco IOS Release 12.3 and Cisco IOS Release 12.3 T, see Caveats for Cisco IOS Release 12.3 T. These documents lists severity 1 and severity 2 caveats and only selected severity 3 caveats, and are located on Cisco.com and the Documentation CD-ROM.
Caveat numbers and brief descriptions for Release 12.3(4)XD4 are listed in this section.
Note
http://www.cisco.com/cgi-bin/Support/Bugtool/launch_bugtool.pl
Open Caveats—Cisco IOS Release 12.3(4)XD4
There are no open caveats specific to Cisco IOS Release 12.3(4)XD4 that require documentation in the release notes.
Resolved Caveats—Cisco IOS Release 12.3(4)XD4
All the caveats listed in this section are resolved in Cisco IOS Release 12.3(4)XD4. This section describes only severity 1 and 2 caveats and select severity 3 caveats.
Caveat Advisories - Resolved Caveats
•
A document that describes how the Internet Control Message Protocol (ICMP) could be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol (TCP) has been made publicly available. This document has been published through the Internet Engineering Task Force (IETF) Internet Draft process, and is entitled "ICMP Attacks Against TCP" (draft-gont-tcpm-icmp-attacks-03.txt).
These attacks, which only affect sessions terminating or originating on a device itself, can be of three types:
1. Attacks that use ICMP "hard" error messages
2. Attacks that use ICMP "fragmentation needed and Don't Fragment (DF) bit set" messages, also known as Path Maximum Transmission Unit Discovery (PMTUD) attacks
3. Attacks that use ICMP "source quench" messagesSuccessful attacks may cause connection resets or reduction of throughput in existing connections, depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml.
The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple vendors whose products are potentially affected. Its posting can be found at: http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en.
•
A document that describes how the Internet Control Message Protocol (ICMP) could be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol (TCP) has been made publicly available. This document has been published through the Internet Engineering Task Force (IETF) Internet Draft process, and is entitled "ICMP Attacks Against TCP" (draft-gont-tcpm-icmp-attacks-03.txt).
These attacks, which only affect sessions terminating or originating on a device itself, can be of three types:
1. Attacks that use ICMP "hard" error messages
2. Attacks that use ICMP "fragmentation needed and Don't Fragment (DF) bit set" messages, also known as Path Maximum Transmission Unit Discovery (PMTUD) attacks
3. Attacks that use ICMP "source quench" messagesSuccessful attacks may cause connection resets or reduction of throughput in existing connections, depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml.
The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple vendors whose products are potentially affected. Its posting can be found at: http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en.
•
A document that describes how the Internet Control Message Protocol (ICMP) could be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol (TCP) has been made publicly available. This document has been published through the Internet Engineering Task Force (IETF) Internet Draft process, and is entitled "ICMP Attacks Against TCP" (draft-gont-tcpm-icmp-attacks-03.txt).
These attacks, which only affect sessions terminating or originating on a device itself, can be of three types:
1. Attacks that use ICMP "hard" error messages
2. Attacks that use ICMP "fragmentation needed and Don't Fragment (DF) bit set" messages, also known as Path Maximum Transmission Unit Discovery (PMTUD) attacks
3. Attacks that use ICMP "source quench" messagesSuccessful attacks may cause connection resets or reduction of throughput in existing connections, depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml.
The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple vendors whose products are potentially affected. Its posting can be found at: http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en.
•
A document that describes how the Internet Control Message Protocol (ICMP) could be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol (TCP) has been made publicly available. This document has been published through the Internet Engineering Task Force (IETF) Internet Draft process, and is entitled "ICMP Attacks Against TCP" (draft-gont-tcpm-icmp-attacks-03.txt).
These attacks, which only affect sessions terminating or originating on a device itself, can be of three types:
1. Attacks that use ICMP "hard" error messages
2. Attacks that use ICMP "fragmentation needed and Don't Fragment (DF) bit set" messages, also known as Path Maximum Transmission Unit Discovery (PMTUD) attacks
3. Attacks that use ICMP "source quench" messagesSuccessful attacks may cause connection resets or reduction of throughput in existing connections, depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml.
The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple vendors whose products are potentially affected. Its posting can be found at: http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en.
•
A document that describes how the Internet Control Message Protocol (ICMP) could be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol (TCP) has been made publicly available. This document has been published through the Internet Engineering Task Force (IETF) Internet Draft process, and is entitled "ICMP Attacks Against TCP" (draft-gont-tcpm-icmp-attacks-03.txt).
These attacks, which only affect sessions terminating or originating on a device itself, can be of three types:
1. Attacks that use ICMP "hard" error messages
2. Attacks that use ICMP "fragmentation needed and Don't Fragment (DF) bit set" messages, also known as Path Maximum Transmission Unit Discovery (PMTUD) attacks
3. Attacks that use ICMP "source quench" messagesSuccessful attacks may cause connection resets or reduction of throughput in existing connections, depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml.
The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple vendors whose products are potentially affected. Its posting can be found at: http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en.
•
A document that describes how the Internet Control Message Protocol (ICMP) could be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol (TCP) has been made publicly available. This document has been published through the Internet Engineering Task Force (IETF) Internet Draft process, and is entitled "ICMP Attacks Against TCP" (draft-gont-tcpm-icmp-attacks-03.txt).
These attacks, which only affect sessions terminating or originating on a device itself, can be of three types:
1. Attacks that use ICMP "hard" error messages
2. Attacks that use ICMP "fragmentation needed and Don't Fragment (DF) bit set" messages, also known as Path Maximum Transmission Unit Discovery (PMTUD) attacks
3. Attacks that use ICMP "source quench" messagesSuccessful attacks may cause connection resets or reduction of throughput in existing connections, depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml.
The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple vendors whose products are potentially affected. Its posting can be found at: http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en.
•
A document that describes how the Internet Control Message Protocol (ICMP) could be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol (TCP) has been made publicly available. This document has been published through the Internet Engineering Task Force (IETF) Internet Draft process, and is entitled "ICMP Attacks Against TCP" (draft-gont-tcpm-icmp-attacks-03.txt).
These attacks, which only affect sessions terminating or originating on a device itself, can be of three types:
1. Attacks that use ICMP "hard" error messages
2. Attacks that use ICMP "fragmentation needed and Don't Fragment (DF) bit set" messages, also known as Path Maximum Transmission Unit Discovery (PMTUD) attacks
3. Attacks that use ICMP "source quench" messagesSuccessful attacks may cause connection resets or reduction of throughput in existing connections, depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml.
The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple vendors whose products are potentially affected. Its posting can be found at: http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en.
•
A document that describes how the Internet Control Message Protocol (ICMP) could be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol (TCP) has been made publicly available. This document has been published through the Internet Engineering Task Force (IETF) Internet Draft process, and is entitled "ICMP Attacks Against TCP" (draft-gont-tcpm-icmp-attacks-03.txt).
These attacks, which only affect sessions terminating or originating on a device itself, can be of three types:
1. Attacks that use ICMP "hard" error messages
2. Attacks that use ICMP "fragmentation needed and Don't Fragment (DF) bit set" messages, also known as Path Maximum Transmission Unit Discovery (PMTUD) attacks
3. Attacks that use ICMP "source quench" messagesSuccessful attacks may cause connection resets or reduction of throughput in existing connections, depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml.
The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple vendors whose products are potentially affected. Its posting can be found at: http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en.
•
A document that describes how the Internet Control Message Protocol (ICMP) could be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol (TCP) has been made publicly available. This document has been published through the Internet Engineering Task Force (IETF) Internet Draft process, and is entitled "ICMP Attacks Against TCP" (draft-gont-tcpm-icmp-attacks-03.txt).
These attacks, which only affect sessions terminating or originating on a device itself, can be of three types:
1. Attacks that use ICMP "hard" error messages
2. Attacks that use ICMP "fragmentation needed and Don't Fragment (DF) bit set" messages, also known as Path Maximum Transmission Unit Discovery (PMTUD) attacks
3. Attacks that use ICMP "source quench" messagesSuccessful attacks may cause connection resets or reduction of throughput in existing connections, depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml.
The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple vendors whose products are potentially affected. Its posting can be found at: http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en.
Open Caveats—Cisco IOS Release 12.3(4)XD3
There are no open caveats specific to Cisco IOS Release 12.3(4)XD3 that require documentation in the release notes.
Resolved Caveats—Cisco IOS Release 12.3(4)XD3
All the caveats listed in this section are resolved in Cisco IOS Release 12.3(4)XD3. This section describes only severity 1 and 2 caveats and select severity 3 caveats.
Table 5 Open Caveats for Cisco IOS Release 12.3(4)XD3
CSCed84634
Under High Link Utlization OAM may bring VC down on DSL ATM int
Symptoms: Without the solution for this problem, some of the Operation, Administration, and Maintenance (OAM) packets may be lost over a permanent virtual circuit (PVC) configured on a digital subscriber line (DSL)(either ADSL or G.SHDSL) Interface which may result in the PVC flapping (going down and coming back up). The fix for this bug would introduce delay in sending the OAM requests/replies in the order of tens of milli seconds.
Independent of this bug, the time required to send a OAM packet or respond to a OAM request packet from the far end depends the size of the data packets and the PVC bandwidth.
Workaround: In order to improve OAM response times and as a potential means to prevent the PVC going down, configure a smaller TX RING on a PVC (which will reduce the head of line delay for OAM packets) and configure larger OAM timeouts using the oam retry command and/or reducing the frequency of the the OAM packets using the oam-pvc manage <loopback frequency in seconds> command under the PVC configuration.
It is, however, important to note that for some applications, smaller TXRING values may introduce throughput loss. And the choice of TXRING value should be based on the delay requirements, if any, and the throughput.
CSCee01387
Packet Dropping at High Throughput and Small packet Size
Symptoms: Packet dropping is observed on 12.3(7.4)PI4 on 4-wire DSL ATM with one PVC with vbr-nrt 4608 4608 and packet is sent from Smartbit with 70 IP packet(84 bytes at SmartBit) size and 5432 pps. Interace atm has 5.3 Mb clock.
Workaround: None
CSCee08584
Cisco Internetwork Operating System (IOS) Software release trains 12.1YD, 12.2T, 12.3 and 12.3T, when configured for Cisco's IOS Telephony Service (ITS), Cisco CallManager Express (CME) or Survivable Remote Site Telephony (SRST) may contain a vulnerability in processing certain malformed control protocol messages.
A successful exploitation of this vulnerability may cause a reload of the device and could be exploited repeatedly to produce a Denial of Service (DoS). This advisory is available at http://www.cisco.com/warp/public/707/cisco-sa-20050119-itscme.shtml
Cisco has made free software upgrades available to address this vulnerability for all affected customers.
This vulnerability is documented by Cisco bug ID CSCee08584.
CSCee54372
Perf. counters rollover on the DSLAM may bring the SHDSL line down
Symptoms: The performance counter values (es, ses, crc, uas, losw) sent through the embedded operation channel (EOC) by the WIC-1SHDSL are occasionally interpreted as extremely high values by a third-party DSLAM.
For example, even though the customer premise equipment (CPE) sends 0 as the CRC value, the DSLAM displays it as 65536. Depending upon the configuration of the DSLAM, the line may come DOWN due to perceived overflow of the counters, even though there is no real overflow.
Workaround: None
CSCee76166
WIC-1-SHDSL-V2 may take long time to train with ECI DSLAM in 4-wire
Symptoms: When multiple virtual circuits (VC) are configured, there is a possibility of losing bandwidth for one of the VCs. This may result in packet drops if the traffic on the VC pumped to the VC-configured bandwidth.
Conditions: This will happens when more than 2 VC are configured with a specific bandwidth only.
Workaround : Reordering the VC configuration may help. There is no workaround.
Open Caveats—Cisco IOS Release 12.3(4)XD2
There are no open caveats specific to Cisco IOS Release 12.3(4)XD2 that require documentation in the release notes.
Resolved Caveats—Cisco IOS Release 12.3(4)XD2
All the caveats listed in this section are resolved in Cisco IOS Release 12.3(4)XD2. This section describes only severity 1 and 2 caveats and select severity 3 caveats.
Open Caveats—Cisco IOS Release 12.3(4)XD1
There are no open caveats specific to Cisco IOS Release 12.3(4)XD1 that require documentation in the release notes.
Resolved Caveats—Cisco IOS Release 12.3(4)XD1
All the caveats listed in this section are resolved in Cisco IOS Release 12.3(4)XD1. This section describes only severity 1 and 2 caveats and select severity 3 caveats.
Table 7 Open Caveats for Cisco IOS Release 12.3(4)XD1
CSCed27956
A vulnerability in the Transmission Control Protocol (TCP) specification (RFC793) has been discovered by an external researcher. The successful exploitation enables an adversary to reset any established TCP connection in a much shorter time than was previously discussed publicly. Depending on the application, the connection may get automatically re-established. In other cases, a user will have to repeat the action (for example, open a new Telnet or SSH session). Depending upon the attacked protocol, a successful attack may have additional consequences beyond terminated connection which must be considered. This attack vector is only applicable to the sessions which are terminating on a device (such as a router, switch, or computer) and not to the sessions that are only passing through the device (for example, transit traffic that is being routed by a router). In addition, this attack vector does not directly compromise data integrity or confidentiality.
All Cisco products which contain TCP stack are susceptible to this vulnerability.
This advisory is available at http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml, and it describes this vulnerability as it applies to Cisco products that run Cisco IOS® software.
A companion advisory that describes this vulnerability for products that do not run Cisco IOS software is available at http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-nonios.shtml.
CSCed38527
A vulnerability in the Transmission Control Protocol (TCP) specification (RFC793) has been discovered by an external researcher. The successful exploitation enables an adversary to reset any established TCP connection in a much shorter time than was previously discussed publicly. Depending on the application, the connection may get automatically re-established. In other cases, a user will have to repeat the action (for example, open a new Telnet or SSH session). Depending upon the attacked protocol, a successful attack may have additional consequences beyond terminated connection which must be considered. This attack vector is only applicable to the sessions which are terminating on a device (such as a router, switch, or computer) and not to the sessions that are only passing through the device (for example, transit traffic that is being routed by a router). In addition, this attack vector does not directly compromise data integrity or confidentiality.
All Cisco products which contain TCP stack are susceptible to this vulnerability.
This advisory is available at http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml, and it describes this vulnerability as it applies to Cisco products that run Cisco IOS® software.
A companion advisory that describes this vulnerability for products that do not run Cisco IOS software is available at http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-nonios.shtml.
Open Caveats—Cisco IOS Release 12.3(4)XD
There are no open caveats specific to Cisco IOS Release 12.3(4)XD that require documentation in the release notes.
Resolved Caveats—Cisco IOS Release 12.3(4)XD
There are no resolved caveats specific to Cisco IOS Release 12.3(4)XD that require documentation in the release notes.
Guest
