Tony and Fred pointed out that a bug was found in the Cisco PIX firewall that could cause a denial of service condition from spoofed TCP SYN packets.  Details on the bug can be found here and Cisco's reply is available here.