Cisco IPsec VPN Client Group Password Disclosure Vulnerability
BID:10155
Info
Cisco IPsec VPN Client Group Password Disclosure Vulnerability
| Bugtraq ID: | 10155 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Apr 15 2004 12:00AM |
| Updated: | Apr 15 2004 12:00AM |
| Credit: | Karl Gaissmaier is credited with discovering this issue in Linux based products, Jonas Eriksson and Nicholas Kathmann are credited with the discovery of this vulnerability in the Windows based equivalent. |
| Vulnerable: |
Cisco VPN Client for Windows 4.0.2 C Cisco VPN Client for Windows 4.0.2 A Cisco VPN Client for Windows 3.6.1 Cisco VPN Client for Windows 3.6 (Rel) Cisco VPN Client for Windows 3.6 Cisco VPN Client for Windows 3.5.4 Cisco VPN Client for Windows 3.5.2 B Cisco VPN Client for Windows 3.5.2 Cisco VPN Client for Windows 3.5.1 C Cisco VPN Client for Windows 3.5.1 Cisco VPN Client for Windows 3.1 Cisco VPN Client for Windows 3.0.5 Cisco VPN Client for Windows 3.0 Cisco VPN Client for Windows 2.0 Cisco VPN Client for Linux 3.6.1 Cisco VPN Client for Linux 3.6 Cisco VPN Client for Linux 3.5.4 Cisco VPN Client for Linux 3.5.2 B Cisco VPN Client for Linux 3.5.2 Cisco VPN Client for Linux 3.5.1 |
| Not Vulnerable: | |
Discussion
Cisco IPsec VPN Client Group Password Disclosure Vulnerability
The Cisco IPsec VPN client has been reported prone to a vulnerability, which may result in the compromise of the Group Password. The issue is reported to present itself because the Group Password is not encrypted or obfuscated in any way when it is stored in process memory.
The Cisco IPsec VPN client has been reported prone to a vulnerability, which may result in the compromise of the Group Password. The issue is reported to present itself because the Group Password is not encrypted or obfuscated in any way when it is stored in process memory.
Exploit / POC
Cisco IPsec VPN Client Group Password Disclosure Vulnerability
It is reported that an exploit exists that leverages this issue. It is not known whether this exploit is circulating in the wild or not.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
It is reported that an exploit exists that leverages this issue. It is not known whether this exploit is circulating in the wild or not.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Cisco IPsec VPN Client Group Password Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Cisco IPsec VPN Client Group Password Disclosure Vulnerability
References:
References: