Cisco VPN Client for Windows Local Denial of Service Vulnerability

Bugtraq ID:	27289
Class:	Design Error
CVE:	CVE-2008-0324
Remote:	No
Local:	Yes
Published:	Jan 15 2008 12:00AM
Updated:	May 07 2015 05:33PM
Credit:	[email protected] discovered this issue.
Vulnerable:	Cisco VPN Client for Windows 5.0.2 .0090
Not Vulnerable:

Cisco VPN Client for Windows Local Denial of Service Vulnerability

Cisco VPN Client for Windows is prone to a local denial-of-service vulnerability because the software's IPsec driver fails to handle certain IOCTLs.

Successfully exploiting this issue allows local attackers to crash affected computers, denying further service to legitimate users.

This issue affects 'cvpndrva.sys' 5.0.02.0090; other versions of the driver may also be affected.

Cisco VPN Client for Windows Local Denial of Service Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/cpndrv-dos.c

Cisco VPN Client for Windows Local Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Cisco VPN Client for Windows Local Denial of Service Vulnerability

References:

• VPN Client (Cisco Systems)