Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » Cisco Security Advisory: Cisco VPN 3000 Concentrator Multiple Vulnerabilities

Cisco Security Advisory: Cisco VPN 3000 Concentrator Multiple Vulnerabilities

by Nikola Strahija on September 3rd, 2002 The Cisco VPN 3000 series concentrators are a family of purpose-built, remote access Virtual Private Network (VPN) platforms for data encryption and authentication.


This advisory documents multiple vulnerabilities for the Cisco VPN 3000
series concentrators and Cisco VPN 3002 Hardware Client. These
vulnerabilities are documented as Cisco bug ID's CSCdt56514, CSCdu15622,
CSCdu35577, CSCdu82823, CSCdv66718, CSCdv88230, CSCdw22408, CSCdw50657,
CSCdx07754, CSCdx24622, CSCdx24632, CSCdx39981, CSCdx54675 and CSCdy38035.
Upgrading to the latest version of code for the Cisco VPN 3000 series
concentrators and Cisco VPN 3002 Hardware Client, version 3.5.5 or 3.6.1,
would protect against all of these documented vulnerabilities.

This advisory will be posted at
http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml.

Affected Products

The Cisco VPN 3000 series concentrators are affected by these
vulnerabilities. This series includes models 3005, 3015, 3030, 3060, 3080
and the Cisco VPN 3002 Hardware Client.

+-------------------------------------------------+
| DDTS - Description | Affected Releases |
|-----------------------------+-------------------|
| CSCdt56514 - PPTP, IPSEC | * 3.6(Rel) |
| internal authentication | * 3.5(Rel) to |
| login vulnerability | 3.5.4 |
| | * earlier than |
| | 3.1.2 |
| | * earlier than |
| | 3.0.3(B) |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdu15622 - HTML parser | * earlier than |
| processing vulnerability | 3.0.3(B) |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdu35577 - Concentrator | * earlier than |
| gives out too much | 3.5.4 |
| information in application | * 3.1.x |
| layer banners | * 3.0.x |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdu82823 - BSD sourced | * earlier than |
| telnetd vulnerability | 3.0.4 |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdv66718 - Windows PPTP | * earlier than |
| client vulnerability | 2.5.2(F) |
|-----------------------------+-------------------|
| CSCdv88230, CSCdw22408 - | * earlier than |
| User passwords visible with | 3.5.1 |
| HTML view source | * earlier than |
| vulnerability | 3.1.4 |
| | * 3.0.x |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdw50657 - Certificate | * earlier than |
| passwords visible with HTML | 3.5.2 |
| view source vulnerability | * 3.1.x |
| | * 3.0.x |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdx07754 - XML public | * earlier than |
| rule vulnerability | 3.5.3 |
| | * 3.1.x |
| | * 3.0.x |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdx24622 - HTML pages | * earlier than |
| access vulnerability | 3.5.3 |
| | * 3.1.x |
| | * 3.0.x |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdx24632 - HTML login | * earlier than |
| processing vulnerability | 3.5.3 |
| | * 3.1.x |
| | * 3.0.x |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdx39981 - VPN client | * 3.6(Rel) |
| authentication | * earlier than |
| vulnerability | 3.5.5 |
| | * 3.1.x |
| | * 3.0.x |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdx54675 - LAN-to-LAN | * earlier than |
| IPSEC tunnel vulnerability | 3.5.4 |
| | * 3.1.x |
| | * 3.0.x |
| | * 2.x.x |
|-----------------------------+-------------------|
| CSCdy38035 - ISAKMP packet | * 3.6(Rel) |
| processing vulnerability | * earlier than |
| | 3.5.5 |
| | * 3.1.x |
| | * 3.0.x |
| | * 2.x.x |
+-------------------------------------------------+

These vulnerabilities do not affect the VPN Client software nor the Cisco
VPN 5000 series concentrators. No other Cisco product is known to be
affected by these vulnerabilities.

To determine if a Cisco VPN 3000 series concentrator is running affected
software, check the software revision via the web interface or the console
menu.

Details

+-------------------------------------------------+
| DDTS - | Details |
| Description | |
|------------------+------------------------------|
| CSCdt56514 - | If a Cisco VPN 3000 series |
| PPTP, IPSEC | concentrator is set up for |
| internal | internal authentication with |
| authentication | only group accounts |
| login | configured and no user |
| vulnerability | accounts configured, then a |
| | VPN client logging in using |
| | PPTP or IPSEC user |
| | authentication succeeds by |
| | using a group name/password |
| | as login credentials. |
| | For VPN client connections |
| | using IPSEC user |
| | authentication, the Cisco |
| | VPN series concentrator will |
| | not allow the VPN client to |
| | use the same group |
| | name/password as what is |
| | configured in the VPN |
| | client's connection |
| | properties, but if another |
| | group account exists on the |
| | concentrator, then using its |
| | group name/password the VPN |
| | client can authenticate to |
| | the VPN concentrator. |
| | The Cisco VPN 3002 Hardware |
| | Client does not support PPTP |
| | or incoming connections and |
| | therefore is not vulnerable |
| | to this problem. |
|------------------+------------------------------|
| CSCdu15622 - | Very long URL requests to |
| HTML parser | the HTML interface cause the |
| processing | VPN 3000 series concentrator |
| vulnerability | to stop responding. The CPU |
| | on the Cisco VPN |
| | concentrator jumps to 100%. |
| | The IP stack of the VPN |
| | concentrator stops |
| | responding. |
| | The VPN concentrator |
| | recovers approximately five |
| | minutes after the DoS attack |
| | is stopped. |
|------------------+------------------------------|
| CSCdu35577 - | The Cisco VPN 3000 series |
| Concentrator | concentrators give out too |
| gives out too | much information in |
| much information | application layer banners. |
| in application | The SSH banner gives out |
| layer banners | information about the device |
| | apart from the SSH version |
| | numbers. The FTP banner |
| | gives information about the |
| | device and the local time. |
| | An incorrect HTTP page |
| | request gives out |
| | information about the |
| | device, the name of the |
| | person who compiled the |
| | software and the time of |
| | compilation. |
|------------------+------------------------------|
| CSCdu82823 - BSD | Cisco VPN 3000 series |
| sourced telnetd | concentrators run telnetd |
| vulnerability | daemon code derived from the |
| | BSD source and are |
| | vulnerable to a buffer |
| | overflow in the telnet |
| | option handling, which can |
| | cause the telnet daemon to |
| | crash and result in a VPN |
| | concentrator reload. This |
| | vulnerability is also |
| | documented as CERT Advisory |
| | CA-2001-21. |
| | Telnet is not permitted on |
| | the public interface of the |
| | VPN concentrator in the |
| | default configuration and is |
| | never permitted on the |
| | public interface of the VPN |
| | 3002 Hardware Client. |
|------------------+------------------------------|
| CSCdv66718 - | Windows native PPTP clients |
| Windows PPTP | connecting with the No |
| client | Encryption option set can |
| vulnerability | cause the Cisco VPN 3000 |
| | series concentrator, with |
| | encryption set, to reload. |
|------------------+------------------------------|
| CSCdv88230, | On password containing HTML |
| CSCdw22408 - | pages for the Cisco VPN 3000 |
| User passwords | series concentrator it is |
| visible with | possible for restricted |
| HTML view source | access administrative users |
| vulnerability | to observe the password in |
| | clear text upon viewing the |
| | source of the web page |
| | without having the |
| | appropriate level of |
| | administrative access. |
|------------------+------------------------------|
| CSCdw50657 - | On the Certificate |
| Certificate | Management HTML pages for |
| passwords | the Cisco VPN 3000 series |
| visible with | concentrator it is possible |
| HTML view source | for administrative users to |
| vulnerability | observe the unencrypted |
| | certificate password in |
| | clear text upon viewing the |
| | source of the web page. |
|------------------+------------------------------|
| CSCdx07754 - XML | When a Cisco VPN 3000 series |
| public rule | concentrator has the XML |
| vulnerability | filter configuration enabled |
| | on its public interface, the |
| | configuration adds the rule |
| | "HTTPS on Public Inbound |
| | (XML-Auto)(forward/in)" to |
| | the public filter and sets |
| | the value for the protocol |
| | incorrectly to "ANY" and the |
| | value for the destination |
| | port to "443". The VPN |
| | concentrator checks the |
| | destination port field value |
| | only when the protocol is |
| | set to TCP or UDP. So |
| | enabling this filter |
| | configuration effectively |
| | allows any protocol on any |
| | port through the VPN |
| | Concentrator. |
|------------------+------------------------------|
| CSCdx24622 - | Users can access a few Cisco |
| HTML pages | VPN 3000 series concentrator |
| access | HTML pages containing |
| vulnerability | limited information without |
| | proper authentication. |
|------------------+------------------------------|
| CSCdx24632 - | It is possible to cause the |
| HTML login | Cisco VPN 3000 series |
| processing | concentrator to reload by |
| vulnerability | modifying an HTML file and |
| | posting very large strings |
| | as the username/password |
| | while accessing the HTML |
| | interface on the VPN |
| | concentrator. |
|------------------+------------------------------|
| CSCdx39981 - VPN | When using a VPN client it |
| client | is possible to cause the |
| authentication | Cisco VPN 3000 series |
| vulnerability | concentrator to reload by |
| | responding with a very large |
| | string for the username |
| | prompt. |
|------------------+------------------------------|
| CSCdx54675 - | The Cisco VPN 3000 series |
| LAN-to-LAN IPSEC | concentrator does not drop |
| tunnel | an incoming LAN-to-LAN |
| vulnerability | connection even when it |
| | already has a security |
| | association for the same |
| | remote network with another |
| | device. Instead it |
| | disconnects the previously |
| | established connection and |
| | establishes a connection |
| | with the new device. The VPN |
| | concentrator also does not |
| | verify if the data coming |
| | across a LAN-to-LAN |
| | connection is being sourced |
| | from the correct network. |
|------------------+------------------------------|
| CSCdy38035 - | Malformed or very large |
| ISAKMP packet | ISAKMP packets can cause |
| processing | device reloads in four |
| vulnerability | instances: |
| | * Upon receipt of a |
| | malformed ISAKMP packet |
| | * Upon having debug turned |
| | on during the receipt of |
| | various malformed |
| | packets |
| | * Upon receiving a very |
| | large number of payloads |
| | in an ISAKMP packet |
| | * Upon having debug turned |
| | on while receiving large |
| | ISAKMP packets. |
+-------------------------------------------------+

These vulnerabilities are documented as Cisco bug ID's CSCdt56514,
CSCdu15622, CSCdu35577, CSCdu82823, CSCdv66718, CSCdv88230, CSCdw22408,
CSCdw50657, CSCdx07754, CSCdx24622, CSCdx24632, CSCdx39981, CSCdx54675 and
CSCdy38035, which require a CCO account to view and can be viewed after
2002 September 4 at 1500 UTC.

Impact

+-------------------------------------------------+
| DDTS - Description | Impact |
|------------------------+------------------------|
| CSCdt56514 - PPTP, | Unintended access to |
| IPSEC internal | the network serviced |
| authentication login | by the VPN 3000 series |
| vulnerability | concentrator. |
|------------------------+------------------------|
| CSCdu15622 - HTML | This vulnerability can |
| parser processing | be exploited to |
| vulnerability | initiate a DOS attack. |
|------------------------+------------------------|
| CSCdu35577 - | The extra information |
| Concentrator gives out | given out could help |
| too much information | an attacker plan his |
| in application layer | attacks. |
| banners | |
|------------------------+------------------------|
| CSCdu82823 - BSD | This vulnerability can |
| sourced telnetd | be exploited to |
| vulnerability | initiate a DOS attack. |
|------------------------+------------------------|
| CSCdv66718 - Windows | This vulnerability can |
| PPTP client | be exploited to |
| vulnerability | initiate a DOS attack. |
|------------------------+------------------------|
| CSCdv88230, CSCdw22408 | Unintended disclosure |
| - User passwords | of passwords on non |
| visible with HTML view | administrative user |
| source vulnerability | accessed HTML pages. |
|------------------------+------------------------|
| CSCdw50657 - | Unintended disclosure |
| Certificate passwords | of passwords on an |
| visible with HTML view | administrative user |
| source vulnerability | accessed HTML page. |
|------------------------+------------------------|
| CSCdx07754 - XML | Unintended access to |
| public rule | the network serviced |
| vulnerability | by the Cisco VPN 3000 |
| | series concentrator. |
|------------------------+------------------------|
| CSCdx24622 - HTML | Unintended access to |
| pages access | generic content on a |
| vulnerability | few HTML pages. |
|------------------------+------------------------|
| CSCdx24632 - HTML | This vulnerability can |
| login processing | be exploited to |
| vulnerability | initiate a DOS attack. |
|------------------------+------------------------|
| CSCdx39981 - VPN | This vulnerability can |
| client authentication | be exploited to |
| vulnerability | initiate a DOS attack. |
|------------------------+------------------------|
| CSCdx54675 - | This vulnerability can |
| LAN-to-LAN IPSEC | be exploited to |
| tunnel vulnerability | initiate a DOS attack. |
|------------------------+------------------------|
| CSCdy38035 - ISAKMP | These vulnerabilities |
| packet processing | can be exploited to |
| vulnerability | initiate DOS attacks. |
+-------------------------------------------------+

Software Versions and Fixes

+-------------------------------------------------+
| DDTS - Description | Fixed Releases |
|---------------------------+---------------------|
| CSCdt56514 - PPTP, IPSEC | * 3.6.1 or later |
| internal authentication | * 3.5.5 or later |
| login vulnerability | * 3.1.2 or later |
| | for 3.1.x |
| | releases |
| | * 3.0.3(B) or |
| | later for 3.0.x |
| | releases |
|---------------------------+---------------------|
| CSCdu15622 - HTML parser | * 3.6(Rel) or |
| processing vulnerability | later |
| | * 3.5(Rel) or |
| | later |
| | * 3.1(Rel) or |
| | later |
| | * 3.0.3(B) or |
| | later |
|---------------------------+---------------------|
| CSCdu35577 - Concentrator | * 3.6(Rel) or |
| gives out too much | later |
| information in | * 3.5.4 or later |
| application layer banners | |
|---------------------------+---------------------|
| CSCdu82823 - BSD sourced | * 3.6(Rel) or |
| telnetd vulnerability | later |
| | * 3.5(Rel) or |
| | later |
| | * 3.1(Rel) or |
| | later |
| | * 3.0.4 or later |
|---------------------------+---------------------|
| CSCdv66718 - Windows PPTP | * 3.6(Rel) or |
| client vulnerability | later |
| | * 3.5(Rel) or |
| | later |
| | * 3.1(Rel) or |
| | later |
| | * 3.0(Rel) or |
| | later |
| | * 2.5.2(F) or |
| | later |
|---------------------------+---------------------|
| CSCdv88230, CSCdw22408 - | * 3.6(Rel) or |
| User passwords visible | later |
| with HTML view source | * 3.5.1 or later |
| vulnerability | * 3.1.4 or later |
|---------------------------+---------------------|
| CSCdw50657 - Certificate | * 3.6(Rel) or |
| passwords visible with | later |
| HTML view source | * 3.5.2 or later |
| vulnerability | |
|---------------------------+---------------------|
| CSCdx07754 - XML public | * 3.6(Rel) or |
| rule vulnerability | later |
| | * 3.5.3 or later |
|---------------------------+---------------------|
| CSCdx24622 - HTML pages | * 3.6(Rel) or |
| access vulnerability | later |
| | * 3.5.3 or later |
|---------------------------+---------------------|
| CSCdx24632 - HTML login | * 3.6(Rel) or |
| processing vulnerability | later |
| | * 3.5.3 or later |
|---------------------------+---------------------|
| CSCdx39981 - VPN client | * 3.6.1 or later |
| authentication | * 3.5.5 or later |
| vulnerability | |
|---------------------------+---------------------|
| CSCdx54675 - LAN-to-LAN | * 3.6(Rel) or |
| IPSEC tunnel | later |
| vulnerability | * 3.5.4 or later |
|---------------------------+---------------------|
| CSCdy38035 - ISAKMP | * 3.6.1 or later |
| packet processing | * 3.5.5 or later |
| vulnerability | |
+-------------------------------------------------+

The procedure to upgrade to the fixed software version is detailed at

http://www.cisco.com/univercd/cc/td/doc/product/vpn/vpn3000/vpn3kco/vcoug/usr_3_0/admin.htm#xtocid2259937.

Obtaining Fixed Software

Cisco is offering free software upgrades to address these vulnerabilities
for all affected customers. Customers may only install and expect support
for the feature sets they have purchased.

Customers with service contracts should contact their regular update
channels to obtain the free software upgrade identified via this advisory.
For most customers with service contracts, this means that upgrades should
be obtained through the Software Center on Cisco's worldwide website at
http://www.cisco.com/pcgi-bin/tablebuild.pl/vpn3000-3des. To access this
link you must be a registered user and you must be logged in.

Customers whose Cisco products are provided or maintained through a prior
or existing agreement with third-party support organizations such as Cisco
Partners, authorized resellers, or service providers should contact that
support organization for assistance with obtaining the free software
upgrade(s).

Customers who purchased directly from Cisco but who do not hold a Cisco
service contract, and customers who purchase through third party vendors
but are unsuccessful at obtaining fixed software through their point of
sale, should obtain fixed software by contacting the Cisco Technical
Assistance Center (TAC) using the contact information listed below. In
these cases, customers are entitled to obtain an upgrade to a later
version of the same release or as indicated by the applicable corrected
software version in the Software Versions and Fixes section (noted above).

Cisco TAC contacts are as follows:

* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: [email protected]

See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for
additional TAC contact information, including special localized telephone
numbers and instructions and e-mail addresses for use in various
languages.

Please have your product serial number available and give the URL of this
advisory as evidence of your entitlement to a free upgrade.

Please do not contact either "[email protected]" or
"[email protected]" for software upgrades.

Workarounds

+-------------------------------------------------+
| DDTS - Description | Workarounds / |
| | Mitigation techniques |
|------------------------+------------------------|
| CSCdt56514 - PPTP, | If possible use |
| IPSEC internal | external |
| authentication login | authentication like |
| vulnerability | TACACS+ or RADIUS. |
|------------------------+------------------------|
| CSCdu15622 - HTML | Restrict access to the |
| parser processing | HTML interface such |
| vulnerability | that connections are |
| | permitted only from |
| | trusted sources. |
|------------------------+------------------------|
| CSCdu35577 - | There is no |
| Concentrator gives out | workaround. |
| too much information | |
| in application layer | |
| banners | |
|------------------------+------------------------|
| CSCdu82823 - BSD | Restrict access to the |
| sourced telnetd | telnet interface such |
| vulnerability | that connections are |
| | permitted only from |
| | trusted sources. |
|------------------------+------------------------|
| CSCdv66718 - Windows | If possible configure |
| PPTP client | the VPN 3000 series |
| vulnerability | concentrator for IPSEC |
| | support only. |
|------------------------+------------------------|
| CSCdv88230, CSCdw22408 | Restrict access to the |
| - User passwords | HTML interface such |
| visible with HTML view | that connections are |
| source vulnerability | permitted only from |
| | trusted sources. |
|------------------------+------------------------|
| CSCdw50657 - | Restrict access to the |
| Certificate passwords | HTML interface such |
| visible with HTML view | that connections are |
| source vulnerability | permitted only from |
| | trusted sources. |
|------------------------+------------------------|
| CSCdx07754 - XML | Remove any XML filter |
| public rule | on the public |
| vulnerability | interface. |
|------------------------+------------------------|
| CSCdx24622 - HTML | Restrict access to the |
| pages access | HTML interface such |
| vulnerability | that connections are |
| | permitted only from |
| | trusted sources. |
|------------------------+------------------------|
| CSCdx24632 - HTML | Restrict access to the |
| login processing | HTML interface such |
| vulnerability | that connections are |
| | permitted only from |
| | trusted sources. |
|------------------------+------------------------|
| CSCdx39981 - VPN | There is no |
| client authentication | workaround. |
| vulnerability | |
|------------------------+------------------------|
| CSCdx54675 - | There is no |
| LAN-to-LAN IPSEC | workaround. |
| tunnel vulnerability | |
|------------------------+------------------------|
| CSCdy38035 - ISAKMP | There is no |
| packet processing | workaround. |
| vulnerability | |
+-------------------------------------------------+

The Cisco PSIRT recommends that affected users upgrade to a fixed software
version of code.

Exploitation and Public Announcements

The Cisco PSIRT is not aware of any public announcements or malicious use
of the vulnerability described in this advisory.

These vulnerabilities were reported to PSIRT by internal development
testing and customers. The invalid ISAKMP packet length vulnerability
addressed by CSCdy38035 was reported to the PSIRT by Phenoelit. The
vulnerabilities addressed by CSCdx24622 and CSCdx24632 were reported to
Cisco by Vigilante.

Status of This Notice: FINAL

This is a final advisory. Although Cisco cannot guarantee the accuracy of
all statements in this advisory, all of the facts have been checked to the
best of our ability. Cisco does not anticipate issuing updated versions of
this advisory unless there is some material change in the facts. Should
there be a significant change in the facts, Cisco may update this
advisory.

A stand-alone copy or paraphrase of the text of this security advisory
that omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain factual
errors.

Distribution

This advisory will be posted on Cisco's worldwide website at
http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml.

In addition to worldwide website posting, a text version of this advisory
is clear-signed with the Cisco PSIRT PGP key having the fingerprint FEB1
1B89 A64B 60BB 4770 D1CE 93D2 FF06 F236 759C and is posted to the
following e-mail and Usenet news recipients:

* [email protected]
* [email protected]
* [email protected]
* [email protected] (includes CERT/CC)
* [email protected]
* [email protected]
* [email protected]
* comp.dcom.sys.cisco
* Various internal Cisco mailing lists

Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on mailing
lists or newsgroups. Users concerned about this problem are encouraged to
check the above URL for any updates.

Revision History

+-------------------------------------------------+
| Revision 1.0 | 2002-September-03 | Initial |
| | | public |
| | | release |
+-------------------------------------------------+

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and registering to
receive security information from Cisco, is available on Cisco's worldwide
website at http://www.cisco.com/go/psirt. This includes instructions for
press inquiries regarding Cisco security advisories.

----------------------------------------------------------------------

This advisory is copyright 2002 by Cisco Systems, Inc. This advisory may
be redistributed freely after the release date given at the top of the
text, provided that redistributed copies are complete and unmodified,
including all date and version information.

----------------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8
Comment: Signed by Sharad Ahlawat, Cisco Systems PSIRT

iQA/AwUBPXTpuZPS/wbyNnWcEQKH3QCgqX/zUSCmAGdEztRECYxMzA9DkzQAoPUZ
zlE2/1p6Twm7HHuunr1vQ2p7
=C4g0
-----END PGP SIGNATURE-----


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »