Nortel Contivity VPN Client Gateway Certificate Check Failure Vulnerability

Bugtraq ID:	11495
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 21 2004 12:00AM
Updated:	Oct 21 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to Sylvain Roger <[email protected]>.
Vulnerable:	Nortel Networks Contivity VPN Client 4.91
Not Vulnerable:

Nortel Contivity VPN Client Gateway Certificate Check Failure Vulnerability

Nortel Contivity VPN Client is reported prone to a certificate check failure. The vulnerability is present because the VPN connection is established before the user permits the connection.

This may allow the attacker to launch further attacks against the vulnerable computer.

Nortel Contivity VPN Client Gateway Certificate Check Failure Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Nortel Contivity VPN Client Gateway Certificate Check Failure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Nortel Contivity VPN Client Gateway Certificate Check Failure Vulnerability

References:

• Contivity VPN Client Homepage (Nortel Networks)