Vulnerability

    CISCO

Affected

    CISCO 677

Description

    Vladimir  Kraljevich  found  following.   It  is possible to block
    Cisco 677 with ICMP echo request in which IPOPT_RR is set.  It  is
    not clear what is the cause of crash, but it seems to me that  677
    is  unable  to  properly  handle  ICMP  echo  response.   If   his
    observation  is  true,  it  is  important,  because one can easily
    assemble ICMP echo *response* and send it to Cisco 677.

    Notice also that Cisco 677  is generating wrong checksum value  in
    direct response to ICMP echo  (TTL=1, Cisco should answer).   From
    command line type:

        ping -r 9 216.32.74.55

    After 677 is dead on this way, only hard reset can help.

Solution

    Port 1999 is  the Cisco Discovery  Protocol.  It  was deprecated a
    long time ago,  so it should  npt be available  by default anymore
    (if it is Cisco will try to get it turned off).