Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Cisco :: napl5668.htm

Cisco VPN 3000 Concentrator Multiple Vulnerabilities



4th Sep 2002 [SBWID-5668]
COMMAND

	
		Cisco VPN 3000 Concentrator Multiple Vulnerabilities
	
	

SYSTEMS AFFECTED

	
		Cisco VPN 3000
	
	

PROBLEM

	
		Cisco giant advisory states :
		

		-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
		

		 Cisco Security Advisory: Cisco VPN 3000 Concentrator Multiple Vulnerabilities

		

		Revision 1.0
		

		  For Public Release 2002 September 03 at 1500 UTC

		

		     ----------------------------------------------------------------------

		

		Contents
		

		   Summary

		   Affected Products

		   Details

		   Impact

		   Software Versions and Fixes

		   Obtaining Fixed Software

		   Workarounds

		   Exploitation and Public Announcements

		   Status of This Notice

		   Distribution

		   Revision History

		   Cisco Security Procedures

		

		     ----------------------------------------------------------------------

		

		Summary
		

		   The Cisco VPN 3000 series concentrators are a family of purpose-built,

		   remote access Virtual Private Network (VPN) platforms for data encryption

		   and authentication.

		

		   This advisory documents multiple vulnerabilities for the Cisco VPN 3000

		   series concentrators and Cisco VPN 3002 Hardware Client. These

		   vulnerabilities are documented as Cisco bug ID's CSCdt56514, CSCdu15622,

		   CSCdu35577, CSCdu82823, CSCdv66718, CSCdv88230, CSCdw22408, CSCdw50657,

		   CSCdx07754, CSCdx24622, CSCdx24632, CSCdx39981, CSCdx54675 and CSCdy38035.

		   Upgrading to the latest version of code for the Cisco VPN 3000 series

		   concentrators and Cisco VPN 3002 Hardware Client, version 3.5.5 or 3.6.1,

		   would protect against all of these documented vulnerabilities.

		

		   This advisory will be posted at

		   http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml.

		

		Affected Products
		

		   The Cisco VPN 3000 series concentrators are affected by these

		   vulnerabilities. This series includes models 3005, 3015, 3030, 3060, 3080

		   and the Cisco VPN 3002 Hardware Client.

		

		   +-------------------------------------------------+

		   |     DDTS - Description      | Affected Releases |

		   |-----------------------------+-------------------|

		   | CSCdt56514 - PPTP, IPSEC    |   * 3.6(Rel)      |

		   | internal authentication     |   * 3.5(Rel) to   |

		   | login vulnerability         |     3.5.4         |

		   |                             |   * earlier than  |

		   |                             |     3.1.2         |

		   |                             |   * earlier than  |

		   |                             |     3.0.3(B)      |

		   |                             |   * 2.x.x         |

		   |-----------------------------+-------------------|

		   | CSCdu15622 - HTML parser    |   * earlier than  |

		   | processing vulnerability    |     3.0.3(B)      |

		   |                             |   * 2.x.x         |

		   |-----------------------------+-------------------|

		   | CSCdu35577 - Concentrator   |   * earlier than  |

		   | gives out too much          |     3.5.4         |

		   | information in application  |   * 3.1.x         |

		   | layer banners               |   * 3.0.x         |

		   |                             |   * 2.x.x         |

		   |-----------------------------+-------------------|

		   | CSCdu82823 - BSD sourced    |   * earlier than  |

		   | telnetd vulnerability       |     3.0.4         |

		   |                             |   * 2.x.x         |

		   |-----------------------------+-------------------|

		   | CSCdv66718 - Windows PPTP   |   * earlier than  |

		   | client vulnerability        |     2.5.2(F)      |

		   |-----------------------------+-------------------|

		   | CSCdv88230, CSCdw22408 -    |   * earlier than  |

		   | User passwords visible with |     3.5.1         |

		   | HTML view source            |   * earlier than  |

		   | vulnerability               |     3.1.4         |

		   |                             |   * 3.0.x         |

		   |                             |   * 2.x.x         |

		   |-----------------------------+-------------------|

		   | CSCdw50657 - Certificate    |   * earlier than  |

		   | passwords visible with HTML |     3.5.2         |

		   | view source vulnerability   |   * 3.1.x         |

		   |                             |   * 3.0.x         |

		   |                             |   * 2.x.x         |

		   |-----------------------------+-------------------|

		   | CSCdx07754 - XML public     |   * earlier than  |

		   | rule vulnerability          |     3.5.3         |

		   |                             |   * 3.1.x         |

		   |                             |   * 3.0.x         |

		   |                             |   * 2.x.x         |

		   |-----------------------------+-------------------|

		   | CSCdx24622 - HTML pages     |   * earlier than  |

		   | access vulnerability        |     3.5.3         |

		   |                             |   * 3.1.x         |

		   |                             |   * 3.0.x         |

		   |                             |   * 2.x.x         |

		   |-----------------------------+-------------------|

		   | CSCdx24632 - HTML login     |   * earlier than  |

		   | processing vulnerability    |     3.5.3         |

		   |                             |   * 3.1.x         |

		   |                             |   * 3.0.x         |

		   |                             |   * 2.x.x         |

		   |-----------------------------+-------------------|

		   | CSCdx39981 - VPN client     |   * 3.6(Rel)      |

		   | authentication              |   * earlier than  |

		   | vulnerability               |     3.5.5         |

		   |                             |   * 3.1.x         |

		   |                             |   * 3.0.x         |

		   |                             |   * 2.x.x         |

		   |-----------------------------+-------------------|

		   | CSCdx54675 - LAN-to-LAN     |   * earlier than  |

		   | IPSEC tunnel vulnerability  |     3.5.4         |

		   |                             |   * 3.1.x         |

		   |                             |   * 3.0.x         |

		   |                             |   * 2.x.x         |

		   |-----------------------------+-------------------|

		   | CSCdy38035 - ISAKMP packet  |   * 3.6(Rel)      |

		   | processing vulnerability    |   * earlier than  |

		   |                             |     3.5.5         |

		   |                             |   * 3.1.x         |

		   |                             |   * 3.0.x         |

		   |                             |   * 2.x.x         |

		   +-------------------------------------------------+

		

		   These vulnerabilities do not affect the VPN Client software nor the Cisco

		   VPN 5000 series concentrators. No other Cisco product is known to be

		   affected by these vulnerabilities.

		

		   To determine if a Cisco VPN 3000 series concentrator is running affected

		   software, check the software revision via the web interface or the console

		   menu.

		

		Details
		

		   +-------------------------------------------------+

		   |      DDTS -      |           Details            |

		   |   Description    |                              |

		   |------------------+------------------------------|

		   | CSCdt56514 -     | If a Cisco VPN 3000 series   |

		   | PPTP, IPSEC      | concentrator is set up for   |

		   | internal         | internal authentication with |

		   | authentication   | only group accounts          |

		   | login            | configured and no user       |

		   | vulnerability    | accounts configured, then a  |

		   |                  | VPN client logging in using  |

		   |                  | PPTP or IPSEC user           |

		   |                  | authentication succeeds by   |

		   |                  | using a group name/password  |

		   |                  | as login credentials.        |

		   |                  | For VPN client connections   |

		   |                  | using IPSEC user             |

		   |                  | authentication, the Cisco    |

		   |                  | VPN series concentrator will |

		   |                  | not allow the VPN client to  |

		   |                  | use the same group           |

		   |                  | name/password as what is     |

		   |                  | configured in the VPN        |

		   |                  | client's connection          |

		   |                  | properties, but if another   |

		   |                  | group account exists on the  |

		   |                  | concentrator, then using its |

		   |                  | group name/password the VPN  |

		   |                  | client can authenticate to   |

		   |                  | the VPN concentrator.        |

		   |                  | The Cisco VPN 3002 Hardware  |

		   |                  | Client does not support PPTP |

		   |                  | or incoming connections and  |

		   |                  | therefore is not vulnerable  |

		   |                  | to this problem.             |

		   |------------------+------------------------------|

		   | CSCdu15622 -     | Very long URL requests to    |

		   | HTML parser      | the HTML interface cause the |

		   | processing       | VPN 3000 series concentrator |

		   | vulnerability    | to stop responding. The CPU  |

		   |                  | on the Cisco VPN             |

		   |                  | concentrator jumps to 100%.  |

		   |                  | The IP stack of the VPN      |

		   |                  | concentrator stops           |

		   |                  | responding.                  |

		   |                  | The VPN concentrator         |

		   |                  | recovers approximately five  |

		   |                  | minutes after the DoS attack |

		   |                  | is stopped.                  |

		   |------------------+------------------------------|

		   | CSCdu35577 -     | The Cisco VPN 3000 series    |

		   | Concentrator     | concentrators give out too   |

		   | gives out too    | much information in          |

		   | much information | application layer banners.   |

		   | in application   | The SSH banner gives out     |

		   | layer banners    | information about the device |

		   |                  | apart from the SSH version   |

		   |                  | numbers. The FTP banner      |

		   |                  | gives information about the  |

		   |                  | device and the local time.   |

		   |                  | An incorrect HTTP page       |

		   |                  | request gives out            |

		   |                  | information about the        |

		   |                  | device, the name of the      |

		   |                  | person who compiled the      |

		   |                  | software and the time of     |

		   |                  | compilation.                 |

		   |------------------+------------------------------|

		   | CSCdu82823 - BSD | Cisco VPN 3000 series        |

		   | sourced telnetd  | concentrators run telnetd    |

		   | vulnerability    | daemon code derived from the |

		   |                  | BSD source and are           |

		   |                  | vulnerable to a buffer       |

		   |                  | overflow in the telnet       |

		   |                  | option handling, which can   |

		   |                  | cause the telnet daemon to   |

		   |                  | crash and result in a VPN    |

		   |                  | concentrator reload. This    |

		   |                  | vulnerability is also        |

		   |                  | documented as CERT Advisory  |

		   |                  | CA-2001-21.                  |

		   |                  | Telnet is not permitted on   |

		   |                  | the public interface of the  |

		   |                  | VPN concentrator in the      |

		   |                  | default configuration and is |

		   |                  | never permitted on the       |

		   |                  | public interface of the VPN  |

		   |                  | 3002 Hardware Client.        |

		   |------------------+------------------------------|

		   | CSCdv66718 -     | Windows native PPTP clients  |

		   | Windows PPTP     | connecting with the No       |

		   | client           | Encryption option set can    |

		   | vulnerability    | cause the Cisco VPN 3000     |

		   |                  | series concentrator, with    |

		   |                  | encryption set, to reload.   |

		   |------------------+------------------------------|

		   | CSCdv88230,      | On password containing HTML  |

		   | CSCdw22408 -     | pages for the Cisco VPN 3000 |

		   | User passwords   | series concentrator it is    |

		   | visible with     | possible for restricted      |

		   | HTML view source | access administrative users  |

		   | vulnerability    | to observe the password in   |

		   |                  | clear text upon viewing the  |

		   |                  | source of the web page       |

		   |                  | without having the           |

		   |                  | appropriate level of         |

		   |                  | administrative access.       |

		   |------------------+------------------------------|

		   | CSCdw50657 -     | On the Certificate           |

		   | Certificate      | Management HTML pages for    |

		   | passwords        | the Cisco VPN 3000 series    |

		   | visible with     | concentrator it is possible  |

		   | HTML view source | for administrative users to  |

		   | vulnerability    | observe the unencrypted      |

		   |                  | certificate password in      |

		   |                  | clear text upon viewing the  |

		   |                  | source of the web page.      |

		   |------------------+------------------------------|

		   | CSCdx07754 - XML | When a Cisco VPN 3000 series |

		   | public rule      | concentrator has the XML     |

		   | vulnerability    | filter configuration enabled |

		   |                  | on its public interface, the |

		   |                  | configuration adds the rule  |

		   |                  | "HTTPS on Public Inbound     |

		   |                  | (XML-Auto)(forward/in)" to   |

		   |                  | the public filter and sets   |

		   |                  | the value for the protocol   |

		   |                  | incorrectly to "ANY" and the |

		   |                  | value for the destination    |

		   |                  | port to "443". The VPN       |

		   |                  | concentrator checks the      |

		   |                  | destination port field value |

		   |                  | only when the protocol is    |

		   |                  | set to TCP or UDP. So        |

		   |                  | enabling this filter         |

		   |                  | configuration effectively    |

		   |                  | allows any protocol on any   |

		   |                  | port through the VPN         |

		   |                  | Concentrator.                |

		   |------------------+------------------------------|

		   | CSCdx24622 -     | Users can access a few Cisco |

		   | HTML pages       | VPN 3000 series concentrator |

		   | access           | HTML pages containing        |

		   | vulnerability    | limited information without  |

		   |                  | proper authentication.       |

		   |------------------+------------------------------|

		   | CSCdx24632 -     | It is possible to cause the  |

		   | HTML login       | Cisco VPN 3000 series        |

		   | processing       | concentrator to reload by    |

		   | vulnerability    | modifying an HTML file and   |

		   |                  | posting very large strings   |

		   |                  | as the username/password     |

		   |                  | while accessing the HTML     |

		   |                  | interface on the VPN         |

		   |                  | concentrator.                |

		   |------------------+------------------------------|

		   | CSCdx39981 - VPN | When using a VPN client it   |

		   | client           | is possible to cause the     |

		   | authentication   | Cisco VPN 3000 series        |

		   | vulnerability    | concentrator to reload by    |

		   |                  | responding with a very large |

		   |                  | string for the username      |

		   |                  | prompt.                      |

		   |------------------+------------------------------|

		   | CSCdx54675 -     | The Cisco VPN 3000 series    |

		   | LAN-to-LAN IPSEC | concentrator does not drop   |

		   | tunnel           | an incoming LAN-to-LAN       |

		   | vulnerability    | connection even when it      |

		   |                  | already has a security       |

		   |                  | association for the same     |

		   |                  | remote network with another  |

		   |                  | device. Instead it           |

		   |                  | disconnects the previously   |

		   |                  | established connection and   |

		   |                  | establishes a connection     |

		   |                  | with the new device. The VPN |

		   |                  | concentrator also does not   |

		   |                  | verify if the data coming    |

		   |                  | across a LAN-to-LAN          |

		   |                  | connection is being sourced  |

		   |                  | from the correct network.    |

		   |------------------+------------------------------|

		   | CSCdy38035 -     | Malformed or very large      |

		   | ISAKMP packet    | ISAKMP packets can cause     |

		   | processing       | device reloads in four       |

		   | vulnerability    | instances:                   |

		   |                  |   * Upon receipt of a        |

		   |                  |     malformed ISAKMP packet  |

		   |                  |   * Upon having debug turned |

		   |                  |     on during the receipt of |

		   |                  |     various malformed        |

		   |                  |     packets                  |

		   |                  |   * Upon receiving a very    |

		   |                  |     large number of payloads |

		   |                  |     in an ISAKMP packet      |

		   |                  |   * Upon having debug turned |

		   |                  |     on while receiving large |

		   |                  |     ISAKMP packets.          |

		   +-------------------------------------------------+

		

		   These vulnerabilities are documented as Cisco bug ID's CSCdt56514,

		   CSCdu15622, CSCdu35577, CSCdu82823, CSCdv66718, CSCdv88230, CSCdw22408,

		   CSCdw50657, CSCdx07754, CSCdx24622, CSCdx24632, CSCdx39981, CSCdx54675 and

		   CSCdy38035, which require a CCO account to view and can be viewed after

		   2002 September 4 at 1500 UTC.

		

		Impact
		

		   +-------------------------------------------------+

		   |   DDTS - Description   |         Impact         |

		   |------------------------+------------------------|

		   | CSCdt56514 - PPTP,     | Unintended access to   |

		   | IPSEC internal         | the network serviced   |

		   | authentication login   | by the VPN 3000 series |

		   | vulnerability          | concentrator.          |

		   |------------------------+------------------------|

		   | CSCdu15622 - HTML      | This vulnerability can |

		   | parser processing      | be exploited to        |

		   | vulnerability          | initiate a DOS attack. |

		   |------------------------+------------------------|

		   | CSCdu35577 -           | The extra information  |

		   | Concentrator gives out | given out could help   |

		   | too much information   | an attacker plan his   |

		   | in application layer   | attacks.               |

		   | banners                |                        |

		   |------------------------+------------------------|

		   | CSCdu82823 - BSD       | This vulnerability can |

		   | sourced telnetd        | be exploited to        |

		   | vulnerability          | initiate a DOS attack. |

		   |------------------------+------------------------|

		   | CSCdv66718 - Windows   | This vulnerability can |

		   | PPTP client            | be exploited to        |

		   | vulnerability          | initiate a DOS attack. |

		   |------------------------+------------------------|

		   | CSCdv88230, CSCdw22408 | Unintended disclosure  |

		   | - User passwords       | of passwords on non    |

		   | visible with HTML view | administrative user    |

		   | source vulnerability   | accessed HTML pages.   |

		   |------------------------+------------------------|

		   | CSCdw50657 -           | Unintended disclosure  |

		   | Certificate passwords  | of passwords on an     |

		   | visible with HTML view | administrative user    |

		   | source vulnerability   | accessed HTML page.    |

		   |------------------------+------------------------|

		   | CSCdx07754 - XML       | Unintended access to   |

		   | public rule            | the network serviced   |

		   | vulnerability          | by the Cisco VPN 3000  |

		   |                        | series concentrator.   |

		   |------------------------+------------------------|

		   | CSCdx24622 - HTML      | Unintended access to   |

		   | pages access           | generic content on a   |

		   | vulnerability          | few HTML pages.        |

		   |------------------------+------------------------|

		   | CSCdx24632 - HTML      | This vulnerability can |

		   | login processing       | be exploited to        |

		   | vulnerability          | initiate a DOS attack. |

		   |------------------------+------------------------|

		   | CSCdx39981 - VPN       | This vulnerability can |

		   | client authentication  | be exploited to        |

		   | vulnerability          | initiate a DOS attack. |

		   |------------------------+------------------------|

		   | CSCdx54675 -           | This vulnerability can |

		   | LAN-to-LAN IPSEC       | be exploited to        |

		   | tunnel vulnerability   | initiate a DOS attack. |

		   |------------------------+------------------------|

		   | CSCdy38035 - ISAKMP    | These vulnerabilities  |

		   | packet processing      | can be exploited to    |

		   | vulnerability          | initiate DOS attacks.  |

		   +-------------------------------------------------+

		
	
	

SOLUTION

	
		

		Software Versions and Fixes
		

		   +-------------------------------------------------+

		   |    DDTS - Description     |   Fixed Releases    |

		   |---------------------------+---------------------|

		   | CSCdt56514 - PPTP, IPSEC  |   * 3.6.1 or later  |

		   | internal authentication   |   * 3.5.5 or later  |

		   | login vulnerability       |   * 3.1.2 or later  |

		   |                           |     for 3.1.x       |

		   |                           |     releases        |

		   |                           |   * 3.0.3(B) or     |

		   |                           |     later for 3.0.x |

		   |                           |     releases        |

		   |---------------------------+---------------------|

		   | CSCdu15622 - HTML parser  |   * 3.6(Rel) or     |

		   | processing vulnerability  |     later           |

		   |                           |   * 3.5(Rel) or     |

		   |                           |     later           |

		   |                           |   * 3.1(Rel) or     |

		   |                           |     later           |

		   |                           |   * 3.0.3(B) or     |

		   |                           |     later           |

		   |---------------------------+---------------------|

		   | CSCdu35577 - Concentrator |   * 3.6(Rel) or     |

		   | gives out too much        |     later           |

		   | information in            |   * 3.5.4 or later  |

		   | application layer banners |                     |

		   |---------------------------+---------------------|

		   | CSCdu82823 - BSD sourced  |   * 3.6(Rel) or     |

		   | telnetd vulnerability     |     later           |

		   |                           |   * 3.5(Rel) or     |

		   |                           |     later           |

		   |                           |   * 3.1(Rel) or     |

		   |                           |     later           |

		   |                           |   * 3.0.4 or later  |

		   |---------------------------+---------------------|

		   | CSCdv66718 - Windows PPTP |   * 3.6(Rel) or     |

		   | client vulnerability      |     later           |

		   |                           |   * 3.5(Rel) or     |

		   |                           |     later           |

		   |                           |   * 3.1(Rel) or     |

		   |                           |     later           |

		   |                           |   * 3.0(Rel) or     |

		   |                           |     later           |

		   |                           |   * 2.5.2(F) or     |

		   |                           |     later           |

		   |---------------------------+---------------------|

		   | CSCdv88230, CSCdw22408 -  |   * 3.6(Rel) or     |

		   | User passwords visible    |     later           |

		   | with HTML view source     |   * 3.5.1 or later  |

		   | vulnerability             |   * 3.1.4 or later  |

		   |---------------------------+---------------------|

		   | CSCdw50657 - Certificate  |   * 3.6(Rel) or     |

		   | passwords visible with    |     later           |

		   | HTML view source          |   * 3.5.2 or later  |

		   | vulnerability             |                     |

		   |---------------------------+---------------------|

		   | CSCdx07754 - XML public   |   * 3.6(Rel) or     |

		   | rule vulnerability        |     later           |

		   |                           |   * 3.5.3 or later  |

		   |---------------------------+---------------------|

		   | CSCdx24622 - HTML pages   |   * 3.6(Rel) or     |

		   | access vulnerability      |     later           |

		   |                           |   * 3.5.3 or later  |

		   |---------------------------+---------------------|

		   | CSCdx24632 - HTML login   |   * 3.6(Rel) or     |

		   | processing vulnerability  |     later           |

		   |                           |   * 3.5.3 or later  |

		   |---------------------------+---------------------|

		   | CSCdx39981 - VPN client   |   * 3.6.1 or later  |

		   | authentication            |   * 3.5.5 or later  |

		   | vulnerability             |                     |

		   |---------------------------+---------------------|

		   | CSCdx54675 - LAN-to-LAN   |   * 3.6(Rel) or     |

		   | IPSEC tunnel              |     later           |

		   | vulnerability             |   * 3.5.4 or later  |

		   |---------------------------+---------------------|

		   | CSCdy38035 - ISAKMP       |   * 3.6.1 or later  |

		   | packet processing         |   * 3.5.5 or later  |

		   | vulnerability             |                     |

		   +-------------------------------------------------+

		

		   The procedure to upgrade to the fixed software version is detailed at

		   http://www.cisco.com/univercd/cc/td/doc/product/vpn/vpn3000/vpn3kco/vcoug/usr_3_0/admin.htm#xtocid2259937.

		

		Obtaining Fixed Software
		

		   Cisco is offering free software upgrades to address these vulnerabilities

		   for all affected customers. Customers may only install and expect support

		   for the feature sets they have purchased.

		

		   Customers with service contracts should contact their regular update

		   channels to obtain the free software upgrade identified via this advisory.

		   For most customers with service contracts, this means that upgrades should

		   be obtained through the Software Center on Cisco's worldwide website at

		   http://www.cisco.com/pcgi-bin/tablebuild.pl/vpn3000-3des. To access this

		   link you must be a registered user and you must be logged in.

		

		   Customers whose Cisco products are provided or maintained through a prior

		   or existing agreement with third-party support organizations such as Cisco

		   Partners, authorized resellers, or service providers should contact that

		   support organization for assistance with obtaining the free software

		   upgrade(s).

		

		   Customers who purchased directly from Cisco but who do not hold a Cisco

		   service contract, and customers who purchase through third party vendors

		   but are unsuccessful at obtaining fixed software through their point of

		   sale, should obtain fixed software by contacting the Cisco Technical

		   Assistance Center (TAC) using the contact information listed below. In

		   these cases, customers are entitled to obtain an upgrade to a later

		   version of the same release or as indicated by the applicable corrected

		   software version in the Software Versions and Fixes section (noted above).

		

		   Cisco TAC contacts are as follows:

		

		     * +1 800 553 2447 (toll free from within North America)

		     * +1 408 526 7209 (toll call from anywhere in the world)

		     * e-mail: tac@cisco.com

		

		   See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for

		   additional TAC contact information, including special localized telephone

		   numbers and instructions and e-mail addresses for use in various

		   languages.

		

		   Please have your product serial number available and give the URL of this

		   advisory as evidence of your entitlement to a free upgrade.

		

		   Please do not contact either "psirt@cisco.com" or

		   "security-alert@cisco.com" for software upgrades.

		

		Workarounds
		

		   +-------------------------------------------------+

		   |   DDTS - Description   |     Workarounds /      |

		   |                        | Mitigation techniques  |

		   |------------------------+------------------------|

		   | CSCdt56514 - PPTP,     | If possible use        |

		   | IPSEC internal         | external               |

		   | authentication login   | authentication like    |

		   | vulnerability          | TACACS+ or RADIUS.     |

		   |------------------------+------------------------|

		   | CSCdu15622 - HTML      | Restrict access to the |

		   | parser processing      | HTML interface such    |

		   | vulnerability          | that connections are   |

		   |                        | permitted only from    |

		   |                        | trusted sources.       |

		   |------------------------+------------------------|

		   | CSCdu35577 -           | There is no            |

		   | Concentrator gives out | workaround.            |

		   | too much information   |                        |

		   | in application layer   |                        |

		   | banners                |                        |

		   |------------------------+------------------------|

		   | CSCdu82823 - BSD       | Restrict access to the |

		   | sourced telnetd        | telnet interface such  |

		   | vulnerability          | that connections are   |

		   |                        | permitted only from    |

		   |                        | trusted sources.       |

		   |------------------------+------------------------|

		   | CSCdv66718 - Windows   | If possible configure  |

		   | PPTP client            | the VPN 3000 series    |

		   | vulnerability          | concentrator for IPSEC |

		   |                        | support only.          |

		   |------------------------+------------------------|

		   | CSCdv88230, CSCdw22408 | Restrict access to the |

		   | - User passwords       | HTML interface such    |

		   | visible with HTML view | that connections are   |

		   | source vulnerability   | permitted only from    |

		   |                        | trusted sources.       |

		   |------------------------+------------------------|

		   | CSCdw50657 -           | Restrict access to the |

		   | Certificate passwords  | HTML interface such    |

		   | visible with HTML view | that connections are   |

		   | source vulnerability   | permitted only from    |

		   |                        | trusted sources.       |

		   |------------------------+------------------------|

		   | CSCdx07754 - XML       | Remove any XML filter  |

		   | public rule            | on the public          |

		   | vulnerability          | interface.             |

		   |------------------------+------------------------|

		   | CSCdx24622 - HTML      | Restrict access to the |

		   | pages access           | HTML interface such    |

		   | vulnerability          | that connections are   |

		   |                        | permitted only from    |

		   |                        | trusted sources.       |

		   |------------------------+------------------------|

		   | CSCdx24632 - HTML      | Restrict access to the |

		   | login processing       | HTML interface such    |

		   | vulnerability          | that connections are   |

		   |                        | permitted only from    |

		   |                        | trusted sources.       |

		   |------------------------+------------------------|

		   | CSCdx39981 - VPN       | There is no            |

		   | client authentication  | workaround.            |

		   | vulnerability          |                        |

		   |------------------------+------------------------|

		   | CSCdx54675 -           | There is no            |

		   | LAN-to-LAN IPSEC       | workaround.            |

		   | tunnel vulnerability   |                        |

		   |------------------------+------------------------|

		   | CSCdy38035 - ISAKMP    | There is no            |

		   | packet processing      | workaround.            |

		   | vulnerability          |                        |

		   +-------------------------------------------------+

		

		   The Cisco PSIRT recommends that affected users upgrade to a fixed software

		   version of code.

		

		Exploitation and Public Announcements
		

		   The Cisco PSIRT is not aware of any public announcements or malicious use

		   of the vulnerability described in this advisory.

		

		   These vulnerabilities were reported to PSIRT by internal development

		   testing and customers. The invalid ISAKMP packet length vulnerability

		   addressed by CSCdy38035 was reported to the PSIRT by Phenoelit. The

		   vulnerabilities addressed by CSCdx24622 and CSCdx24632 were reported to

		   Cisco by Vigilante.

		

		Status of This Notice: FINAL
		

		   This is a final advisory. Although Cisco cannot guarantee the accuracy of

		   all statements in this advisory, all of the facts have been checked to the

		   best of our ability. Cisco does not anticipate issuing updated versions of

		   this advisory unless there is some material change in the facts. Should

		   there be a significant change in the facts, Cisco may update this

		   advisory.

		

		   A stand-alone copy or paraphrase of the text of this security advisory

		   that omits the distribution URL in the following section is an

		   uncontrolled copy, and may lack important information or contain factual

		   errors.

		

		Distribution
		

		   This advisory will be posted on Cisco's worldwide website at

		   http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml.

		

		   In addition to worldwide website posting, a text version of this advisory

		   is clear-signed with the Cisco PSIRT PGP key having the fingerprint FEB1

		   1B89 A64B 60BB 4770 D1CE 93D2 FF06 F236 759C and is posted to the

		   following e-mail and Usenet news recipients:

		

		     * cust-security-announce@cisco.com

		     * bugtraq@securityfocus.com

		     * full-disclosure@lists.netsys.com

		     * first-teams@first.org (includes CERT/CC)

		     * firewalls@lists.gnac.com

		     * cisco-nsp@puck.nether.net

		     * cisco@spot.colorado.edu

		     * comp.dcom.sys.cisco

		     * Various internal Cisco mailing lists

		

		   Future updates of this advisory, if any, will be placed on Cisco's

		   worldwide website, but may or may not be actively announced on mailing

		   lists or newsgroups. Users concerned about this problem are encouraged to

		   check the above URL for any updates.

		

		Revision History
		

		   +-------------------------------------------------+

		   | Revision 1.0 | 2002-September-03 | Initial      |

		   |              |                   | public       |

		   |              |                   | release      |

		   +-------------------------------------------------+

		

		Cisco Security Procedures
		

		   Complete information on reporting security vulnerabilities in Cisco

		   products, obtaining assistance with security incidents, and registering to

		   receive security information from Cisco, is available on Cisco's worldwide

		   website at http://www.cisco.com/go/psirt. This includes instructions for

		   press inquiries regarding Cisco security advisories.

		

		     ----------------------------------------------------------------------

		

		   This advisory is copyright 2002 by Cisco Systems, Inc. This advisory may

		   be redistributed freely after the release date given at the top of the

		   text, provided that redistributed copies are complete and unmodified,

		   including all date and version information.

		

		     ----------------------------------------------------------------------

		

		-----BEGIN PGP SIGNATURE-----

		Version: PGP 6.5.8

		Comment: Signed by Sharad Ahlawat, Cisco Systems PSIRT

		

		iQA/AwUBPXTpuZPS/wbyNnWcEQKH3QCgqX/zUSCmAGdEztRECYxMzA9DkzQAoPUZ

		zlE2/1p6Twm7HHuunr1vQ2p7

		=C4g0

		-----END PGP SIGNATURE-----

		-----BEGIN PGP PUBLIC KEY BLOCK-----

		Version: PGP 6.5.8

		

		mQGiBD0HcvwRBADMNGazqD/bDWjJVBKrPrW3vSRReXB5y2HGfmZXS0C4xB/3VJGR

		d+JeTnqam4q7hbBab9kery6cNL9cdZWI+LInX8DUT/s+vlUTrIdZmAphxKtDwZLw

		W9rXKLQMeVpNfb64SrIqlcjq/DGEYAqVt3ycPXJiPl8JroDaKFSG1vKbTQCg/xJG

		Ljl1bWvPx6O602cNaX5BrmUEALMSC++ppvP587TCHSdLzhfVBWw+zbt2a+gTkahz

		t+VhymnBNWxNIlbU/U1StEaFwfBVPliVKmTj5LQwPetbIf783q+5ak0W9FM8BYy8

		9XVt8S/AYdYRw5/1YJA3OnprdIwaMDDtrQEy/dmpHYe0Vcay5tSM4M2MgOHJcVba

		hgktBACUHDDduj1qRzEybgLPSmwNS9jFpMC4PebBrw9c2O9idUufGt5A5we/ii5U

		G/0s4vpr1zGhKPbmzWaU5+jSH1XfPVg3EF8H5K7meC7LVPYwYjYi6z1ir07zhEfD

		wDRil5qve6rJNEZX5GLEysDhXYTw8hrwVv7bJSSlsJiMEqllEbRHQ2lzY28gU3lz

		dGVtcyBQcm9kdWN0IFNlY3VyaXR5IEluY2lkZW50IFJlc3BvbnNlIFRlYW0gPHBz

		aXJ0QGNpc2NvLmNvbT6JAF4EEBECAB4FAj0HcvwFCQW9+IAICwMJCAcCAQoCGQEF

		GwMAAAAACgkQk9L/BvI2dZwoYwCgrFpZ5dh8IPAt4C/hkz6o+H9b6IwAoL+kvWjx

		0Ij9mhNoEH+woJJCKjh2iQBKBBARAgAKBQI9B4cLAwUBeAAKCRCKY8lJ671ScWeu

		AJ9QQeUds+YrB8knbCMdoOIizI44pwCfVsbFKOS2mnR6GuPGRHx6TYap/ieJAEYE

		EBECAAYFAj0H3ooACgkQGoGomMEqmWyzPACeMnMro1hvO4ka23G2Z6JhZldeRVEA

		oNom27aJ3+OxrhaUtBJt/SWVdVafiQBjBBARAgAjBQI9B4ieAwUBeBgGPFtePl0r

		W0AuXWNpc2NvXC5jb20+JAAACgkQcJKanG3DGCHNdwCeP+XUPnt12BVZYAf5J+6Q

		g5d9wTAAoM2XXNqrMm5Y/ScvExXoYXyk/q81iQCcBBABAQAGBQI9B4TXAAoJEMAF

		eq0PniW5vLwEALCv9TkPbxdn29NzZJkI9vAqnX4OV79LfvQsB1J+Sck3f1lsvamq

		r6kUsfqz2P4sB52KjZi8Cci3AHDP7Z5Iwl56raNiPEA00uUXh4vk1N7dTA4OfjDp

		1LSciYHYOYxh6d3v47GphnBNckOdCH9iuaWJuRX86SHtshyJvHmR+wOtiQBGBBAR

		AgAGBQI9B4ZCAAoJEOJaQ7r9SlMepRMAoPIlX+Pem9o5r1UjjpxT7aQyiFP/AKCz

		yyQzbP5/IizPfxB2GTK92QSZVYkARgQQEQIABgUCPQeGcQAKCRCXb+VkX5DhIof5

		AKC87+Znu5p+y69Z/szsL5fYv+RT2QCg6TMl/IeLDU9D+hwG6FqHBQbRyuWJAGME

		EBECACMFAj0Pq4IDBQF4GAY8W14+XStbQC5dY2lzY29cLmNvbT4kAAAKCRD4P8wi

		wv94DQX8AJ4mPJORrcEkCQxe7joRf1VJNzvITQCglE7/y1X9T0iI3tpO2zBo5uyb

		KU+JAEYEEBECAAYFAj0XzCQACgkQSQjoesB49NLGSwCdGAFWJOOBFFBBQWiUyQ3l

		7a596OIAoM/iw5ARHocvByCSsHlkYAvORdbIiQEcBBABAgAGBQI9HQOaAAoJELe9

		L3c4tW498B4H/iXMyJpr0u6hU1xaGpPklQjI9oB3TpH0ASxi/SmlGZ1Y/xNzxxrC

		RjPBnRwvPVUSPzJidlF9SGhsGGZVBAfUbMihwmnPr0kbM8SoZGNqF0Vzqraim/ds

		wiw4QUWSGw3csw8h18wtfxipNipnjP06qilHiIHipN4Q7nhuV3nQ+8o8Bz7sZvZS

		ei6JfkT21BcHCLtxfI0022jeTSoQG6GqQjs02rbIKBjOj98Qr6yt4lu4EY3LNMDW

		N9dX+usAf43e2asizF5k1ALIbktaEZQDgq2FYWwXFw1UTlB8lpl4uL5OZ78Bx18V

		NFBedZ4jqIvj8jGk8CbKA8fNOd9EIioXyqm0UENpc2NvIFN5c3RlbXMgUHJvZHVj

		dCBTZWN1cml0eSBJbmNpZGVudCBSZXNwb25zZSBUZWFtIDxzZWN1cml0eS1hbGVy

		dEBjaXNjby5jb20+iQBGBBARAgAGBQI9B3NPAAoJEJPS/wbyNnWc8bcAoL4jgdol

		jMJs8qkGV5s9L8EVHodgAJ41Pnr7cL0AV2cBvdiJjJX0UAOJnokASgQQEQIACgUC

		PQeHHwMFAXgACgkQimPJSeu9UnEShwCfUen+P64gmYXlf6aWMoBudz7/gEgAoKHP

		GMzGRTLPQ2VO27AXfM1qMqOPiQBGBBARAgAGBQI9B96TAAoJEBqBqJjBKplsY2IA

		oN/eovYSQsE34i2tfeSy/3X8vFWXAKDgnRmSe9SGdtLIDXZbPI9VshGnEIkAYwQQ

		EQIAIwUCPQeItwMFAXgYBjxbXj5dK1tALl1jaXNjb1wuY29tPiQAAAoJEHCSmpxt

		wxghLBgAn2cjBC9yOd14unFoJrXv0eKixEQaAKCsDBGsECGI+ru8keXJ2zJYSOF+

		74kAnAQQAQEABgUCPQeFBwAKCRDABXqtD54lua3JBAC+O2uyXzj8wMTThpgeoeBT

		95u4Smug8G+tPVrrkqd2SK8zXlpscAGQugklXw7drmj2Ph8bwocnQxDWQH9kCApj

		eXCWGCBLZnsehghtkaofDq0wp7fugmDwhaRApsERHnRVlCNA/8vB5FMCBfJA6xkU

		riRTvxEmHn5uwcDYgzFJB4kARgQQEQIABgUCPQeGeQAKCRDiWkO6/UpTHtTYAKCA

		8pd5aARjTMjCBfXUL5HqesgeawCgh8pF7agO1H7E6YAoDEAcQK5QNVKJAEYEEBEC

		AAYFAj0HhoQACgkQl2/lZF+Q4SJPKQCg62cLZCePXBq9fn/CUTJa0GeDepkAnjgh

		YGC24VB+E5/4T3wsy98+tsgriQBjBBARAgAjBQI9D6uhAwUBeBgGPFtePl0rW0Au

		XWNpc2NvXC5jb20+JAAACgkQ+D/MIsL/eA1YdACgp7PGp51wgiA9+nRqF8Be826b

		4GYAoN0Xz7k6Vm2wtdANIMFc+11H5gdriQBGBBARAgAGBQI9F8wuAAoJEEkI6HrA

		ePTS7KcAoLcgqYzzNY1g1WK9q/D0cIzzHstFAKDcBTGI3DNtJ6wnqzecq5WPxnmk

		D7kCDQQ9B3L8EAgA9kJXtwh/CBdyorrWqULzBej5UxE5T7bxbrlLOCDaAadWoxTp

		j0BV89AHxstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJPPT2N286Z4VeSWc39

		uK50T8X8dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrUGvC/RgBYK+X0iP1Y

		TknbzSC0neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8BD8KVbGI2Ou1WMuF040zT9

		fBdXQ6MdGGzeMyEstSr/POGxKUAYEY18hKcKctaGxAMZyAcpesqVDNmWn6vQClCb

		AkbTCD1mpF1Bn5x8vYlLIhkmuquiXsNV6TILOwACAgf/dfUAIBxFgArE2xwYooN3

		n6fkM/LIuVIzixkyNSgqH9KaOJ41cn8jncbdt31tyH++aK7mMuyQm7nkgy/B8U7w

		9xYORl1mOsgUSGylPLxo2vengnqBO+Ua5hcngfvLuDUV8N9Ai0TWPfyTveyRQSPY

		ODOapdU8uCk3dFiZpgfTBh7hqlLRiNpTXHEK8dNsEy/q2HqLx/9hTQMXWqViK17q

		CfmwRLO94W1RIk6+CTwIa6tN9+ZicthCHRvUTRxDLfuuyY7qrDa4QM6HFAO+NyN9

		Z9SeZSlbGoUN+AAEPZ9ej1T5Ca0WLCD9tF5a+ujN/GrSg2EidGUh/phZXYKYYsrh

		WYkAUgQYEQIAEgUCPQdy/AUJBb34gAUbDAAAAAAKCRCT0v8G8jZ1nP24AJ9nkeTV

		qE6/EOoOIuhxwtihvhea6wCgx6iK+imU7xZZDSGl9RudFTo08Ew=

		=UuaC

		-----END PGP PUBLIC KEY BLOCK-----

	


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH