Cisco VPN Concentrator Groupname Enumeration Weakness

Bugtraq ID:	13992
Class:	Design Error
CVE:	CVE-2005-2025
Remote:	Yes
Local:	No
Published:	Jun 20 2005 12:00AM
Updated:	Mar 19 2015 08:35AM
Credit:	Discovery is credited to Roy Hills with NTA Monitor Ltd.
Vulnerable:	Cisco VPN 3080 Concentrator Cisco VPN 3060 Concentrator Cisco VPN 3030 Concentrator Cisco VPN 3020 Concentrator Cisco VPN 3015 Concentrator Cisco VPN 3005 Concentrator 4.0.1 Cisco VPN 3005 Concentrator 4.0 Cisco VPN 3005 Concentrator 3.6.7 F Cisco VPN 3005 Concentrator 3.6.7 D Cisco VPN 3005 Concentrator 3.6.7 C Cisco VPN 3005 Concentrator 3.6.7 B Cisco VPN 3005 Concentrator 3.6.7 A Cisco VPN 3005 Concentrator 3.6.7 Cisco VPN 3005 Concentrator 3.6.5 Cisco VPN 3005 Concentrator 3.6.3 Cisco VPN 3000 Concentrator 4.1.5 .B Cisco VPN 3000 Concentrator 4.1 .x Cisco VPN 3000 Concentrator 4.0.5 .B Cisco VPN 3000 Concentrator 4.0.1 Cisco VPN 3000 Concentrator 4.0 .x Cisco VPN 3000 Concentrator 4.0 Cisco VPN 3000 Concentrator 3.6.7 D Cisco VPN 3000 Concentrator 3.6.7 Cisco VPN 3000 Concentrator 3.6.1 Cisco VPN 3000 Concentrator 3.6 Cisco VPN 3000 Concentrator 3.5.5 Cisco VPN 3000 Concentrator 3.5.4 Cisco VPN 3000 Concentrator 3.5.3 Cisco VPN 3000 Concentrator 3.5.2 Cisco VPN 3000 Concentrator 3.5.1 Cisco VPN 3000 Concentrator 3.5 (Rel) Cisco VPN 3000 Concentrator 3.1.4 Cisco VPN 3000 Concentrator 3.1.2 Cisco VPN 3000 Concentrator 3.1.1 Cisco VPN 3000 Concentrator 3.1 (Rel) Cisco VPN 3000 Concentrator 3.1 Cisco VPN 3000 Concentrator 3.0.4 Cisco VPN 3000 Concentrator 3.0.3 (B) Cisco VPN 3000 Concentrator 3.0.3 (A) Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 2.5.2 (F) Cisco VPN 3000 Concentrator 2.5.2 (D) Cisco VPN 3000 Concentrator 2.5.2 (C) Cisco VPN 3000 Concentrator 2.5.2 (B) Cisco VPN 3000 Concentrator 2.5.2 (A) Cisco VPN 3000 Concentrator 2.0 Cisco VPN 3000 Concentrator 4.1.7.B Cisco VPN 3000 Concentrator 4.1.7.A Cisco PIX Firewall 535 0 Cisco PIX Firewall 525 6.3 Cisco PIX Firewall 525 Cisco PIX Firewall 520 Cisco PIX Firewall 515E Cisco PIX Firewall 515 Cisco PIX Firewall 506 0 Cisco PIX Firewall 501 0 Cisco PIX 500 Series Security Appliance 7.0 Cisco IOS 12.4XB Cisco IOS 12.4XA Cisco IOS 12.4T Cisco IOS 12.4 Cisco IOS 12.3YX Cisco IOS 12.3YU Cisco IOS 12.3YT Cisco IOS 12.3YS Cisco IOS 12.3YQ Cisco IOS 12.3YM Cisco IOS 12.3YK Cisco IOS 12.3YI Cisco IOS 12.3YH Cisco IOS 12.3YG Cisco IOS 12.3YF Cisco IOS 12.3YD Cisco IOS 12.3YA Cisco IOS 12.3XX Cisco IOS 12.3XW Cisco IOS 12.3XU Cisco IOS 12.3XS Cisco IOS 12.3XR Cisco IOS 12.3XQ Cisco IOS 12.3XK Cisco IOS 12.3XJ Cisco IOS 12.3XI Cisco IOS 12.3XH Cisco IOS 12.3XG Cisco IOS 12.3XF Cisco IOS 12.3XE Cisco IOS 12.3XD Cisco IOS 12.3XC Cisco IOS 12.3XB Cisco IOS 12.3XA Cisco IOS 12.3TPC Cisco IOS 12.3T Cisco IOS 12.3BC Cisco IOS 12.3B Cisco IOS 12.3 Cisco IOS 12.2ZN Cisco IOS 12.2ZL Cisco IOS 12.2ZJ Cisco IOS 12.2ZH Cisco IOS 12.2ZG Cisco IOS 12.2ZF Cisco IOS 12.2ZE Cisco IOS 12.2ZD Cisco IOS 12.2ZB Cisco IOS 12.2ZA Cisco IOS 12.2YZ Cisco IOS 12.2YY Cisco IOS 12.2YX Cisco IOS 12.2YW Cisco IOS 12.2YU Cisco IOS 12.2YR Cisco IOS 12.2YQ Cisco IOS 12.2YN Cisco IOS 12.2YM Cisco IOS 12.2YL Cisco IOS 12.2YJ Cisco IOS 12.2YF Cisco IOS 12.2YE Cisco IOS 12.2YD Cisco IOS 12.2YC Cisco IOS 12.2YB Cisco IOS 12.2YA Cisco IOS 12.2XW Cisco IOS 12.2XV Cisco IOS 12.2XU Cisco IOS 12.2XT Cisco IOS 12.2XS Cisco IOS 12.2XQ Cisco IOS 12.2XN Cisco IOS 12.2XM Cisco IOS 12.2XL Cisco IOS 12.2XK Cisco IOS 12.2XJ Cisco IOS 12.2XI Cisco IOS 12.2XH Cisco IOS 12.2XG Cisco IOS 12.2XE Cisco IOS 12.2XD Cisco IOS 12.2XB Cisco IOS 12.2XA Cisco IOS 12.2T Cisco IOS 12.2SY Cisco IOS 12.2SXF Cisco IOS 12.2SXE Cisco IOS 12.2SXD Cisco IOS 12.2SXB Cisco IOS 12.2SXA Cisco IOS 12.2SX Cisco IOS 12.2SW Cisco IOS 12.2SU Cisco IOS 12.2S Cisco IOS 12.2DD Cisco IOS 12.2CZ Cisco IOS 12.2CY Cisco IOS 12.2CX Cisco IOS 12.2BZ Cisco IOS 12.2BY Cisco IOS 12.2BW Cisco IOS 12.2BC Cisco IOS 12.2B Cisco IOS 12.2 Cisco IOS 12.1YI Cisco IOS 12.1YF Cisco IOS 12.1YE Cisco IOS 12.1YD Cisco IOS 12.1YC Cisco IOS 12.1YB Cisco IOS 12.1XT Cisco IOS 12.1XQ Cisco IOS 12.1XP Cisco IOS 12.1XM Cisco IOS 12.1XJ Cisco IOS 12.1XI Cisco IOS 12.1XH Cisco IOS 12.1XG Cisco IOS 12.1XF Cisco IOS 12.1XC Cisco IOS 12.1T Cisco IOS 12.1GB Cisco IOS 12.1GA Cisco IOS 12.1EY Cisco IOS 12.1EW Cisco IOS 12.1EC Cisco IOS 12.1EB Cisco IOS 12.1EA Cisco IOS 12.1E Cisco IOS 12.1AZ Cisco IOS 12.1AY Cisco IOS 12.1AX Cisco IOS 12.1 Cisco IOS 12.0XV Cisco IOS 12.0XR Cisco IOS 12.0XQ Cisco IOS 12.0XN Cisco IOS 12.0XL Cisco IOS 12.0XK Cisco IOS 12.0XJ Cisco IOS 12.0XI Cisco IOS 12.0XH Cisco IOS 12.0XG Cisco IOS 12.0XE Cisco IOS 12.0XC Cisco IOS 12.0XA Cisco IOS 12.0T Cisco Adaptive Security Appliance 7.0 (2) Cisco Adaptive Security Appliance 7.0 (0) Cisco Adaptive Security Appliance 7.0 Cisco Adaptive Security Appliance 0
Not Vulnerable:	Cisco VPN 3080 Concentrator 4.7.1 F Cisco VPN 3080 Concentrator 4.7.1 Cisco VPN 3060 Concentrator 4.7.1 F Cisco VPN 3060 Concentrator 4.7.1 Cisco VPN 3030 Concentrator 4.7.1 F Cisco VPN 3030 Concentrator 4.7.1 Cisco VPN 3020 Concentrator 4.7.1 F Cisco VPN 3020 Concentrator 4.7.1 Cisco VPN 3015 Concentrator 4.7.1 F Cisco VPN 3015 Concentrator 4.7.1 Cisco VPN 3005 Concentrator 4.7.1 F Cisco VPN 3005 Concentrator 4.7.1 Cisco VPN 3000 Concentrator 4.7.1 F Cisco PIX 500 Series Security Appliance 7.0(4) Cisco IOS 12.4(6)T Cisco IOS 12.4(5) Cisco IOS 12.4(4)T Cisco IOS 12.3(16) Cisco Ios 12.2(33) Cisco IOS 12.2(25)EY Cisco IOS 12.1(27) Cisco IOS 12.1(26)E6 Cisco IOS 12.1(22)EA8

Cisco VPN Concentrator Groupname Enumeration Weakness

Cisco VPN Concentrator is affected by a remote groupname enumeration weakness. This issue is due to a design error that could assist a remote attacker in enumerating groupnames.

Reportedly, once the attacker has verified a groupname they can obtain a password hash from an affected device and carry out bruteforce attacks against the password hash.

A valid groupname and password pair can allow the attacker to complete IKE Phase-1 authentication and carry out man-in-the-middle attacks against other users. This may ultimately allow the attacker to gain unauthorized access to the network.

All Cisco VPN Concentrator 3000 series products running groupname authentication are considered vulnerable to this issue.

This issue is tracked by the following Cisco BUG IDs:

CSCeg00323, CSCsb38075, and CSCsf25725 - for the Cisco VPN 3000 Series Concentrators
CSCei29901 - for the Cisco PIX 500 Series Security Appliances running code version 7.x
CSCei51783 - for the Cisco ASA 5500 Series Adaptive Security Appliances running code version 7.x
CSCsb26495 and CSCsb33172 - for Cisco IOS® software

Cisco VPN Concentrator Groupname Enumeration Weakness

An exploit is not required.

Cisco VPN Concentrator Groupname Enumeration Weakness

Solution:
Cisco has released Cisco VPN 3000 Series Concentrator version 4.7.1 to address this issue. Please see the Cisco Web reference for more information.

Cisco has released an advisory to address this issue. Please see the referenced advisory for further information on obtaining fixes.

Cisco VPN Concentrator Groupname Enumeration Weakness

References:

• Cisco Security Notice: Cisco IPSec VPN Implementation Group Name Enumeration Vul (Cisco)
  
• Cisco VPN Concentrator Groupname Enumeration Vulnerability (NTA Monitor Ltd)
  
• Release Notes for Cisco VPN 3000 Series Concentrator, Release 4.7.1 (Cisco)