Cisco IPSec VPN Groupname Enumeration Weakness
BID:45161
Info
Cisco IPSec VPN Groupname Enumeration Weakness
| Bugtraq ID: | 45161 |
| Class: | Design Error |
| CVE: |
CVE-2010-4354 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 29 2010 12:00AM |
| Updated: | Mar 19 2015 08:52AM |
| Credit: | Gavin Jones of NGS Secure |
| Vulnerable: |
Cisco VPN 3080 Concentrator 4.7.2 G Cisco VPN 3080 Concentrator 4.7.2 F Cisco VPN 3080 Concentrator 4.7.2 A Cisco VPN 3080 Concentrator 4.7.1 F Cisco VPN 3080 Concentrator 4.7.1 Cisco VPN 3080 Concentrator 4.7 Cisco VPN 3080 Concentrator 4.1.7 M Cisco VPN 3080 Concentrator 4.1.7 L Cisco VPN 3080 Concentrator 4.7 REL Cisco VPN 3080 Concentrator Cisco VPN 3060 Concentrator 4.7.2 G Cisco VPN 3060 Concentrator 4.7.2 A Cisco VPN 3060 Concentrator 4.7.2 Cisco VPN 3060 Concentrator 4.7.1 F Cisco VPN 3060 Concentrator 4.7.1 Cisco VPN 3060 Concentrator 4.7 Cisco VPN 3060 Concentrator 4.1.7 M Cisco VPN 3060 Concentrator 3.5.2 Cisco VPN 3060 Concentrator 4.7 REL Cisco VPN 3060 Concentrator Cisco VPN 3030 Concentrator 4.7.2 G Cisco VPN 3030 Concentrator 4.7.2 F Cisco VPN 3030 Concentrator 4.7.2 A Cisco VPN 3030 Concentrator 4.7.2 Cisco VPN 3030 Concentrator 4.7.1 F Cisco VPN 3030 Concentrator 4.7.1 Cisco VPN 3030 Concentrator 4.7 Cisco VPN 3030 Concentrator 4.1.7 M Cisco VPN 3030 Concentrator 4.1.7 L Cisco VPN 3030 Concentrator 4.0.2 Cisco VPN 3030 Concentrator 4.7 REL Cisco VPN 3030 Concentrator Cisco VPN 3020 Concentrator 4.7.2 G Cisco VPN 3020 Concentrator 4.7.2 F Cisco VPN 3020 Concentrator 4.7.2 A Cisco VPN 3020 Concentrator 4.7.2 Cisco VPN 3020 Concentrator 4.7.1 F Cisco VPN 3020 Concentrator 4.7.1 Cisco VPN 3020 Concentrator 4.7 Cisco VPN 3020 Concentrator 4.1.7 M Cisco VPN 3020 Concentrator 4.1.7 L Cisco VPN 3020 Concentrator 4.7 REL Cisco VPN 3020 Concentrator Cisco VPN 3015 Concentrator 4.7.2 G Cisco VPN 3015 Concentrator 4.7.2 F Cisco VPN 3015 Concentrator 4.7.2 A Cisco VPN 3015 Concentrator 4.7.2 Cisco VPN 3015 Concentrator 4.7.1 F Cisco VPN 3015 Concentrator 4.7.1 Cisco VPN 3015 Concentrator 4.7 Cisco VPN 3015 Concentrator 4.1.7 M Cisco VPN 3015 Concentrator 4.1.7 L Cisco VPN 3015 Concentrator 4.7 REL Cisco VPN 3015 Concentrator Cisco VPN 3005 Concentrator 4.7.2 G Cisco VPN 3005 Concentrator 4.7.2 F Cisco VPN 3005 Concentrator 4.7.2 A Cisco VPN 3005 Concentrator 4.7.2 Cisco VPN 3005 Concentrator 4.7.1 F Cisco VPN 3005 Concentrator 4.7.1 Cisco VPN 3005 Concentrator 4.7 Cisco VPN 3005 Concentrator 4.1.7 M Cisco VPN 3005 Concentrator 4.1.7 L Cisco VPN 3005 Concentrator 4.0.1 Cisco VPN 3005 Concentrator 4.0 Cisco VPN 3005 Concentrator 3.6.7 F Cisco VPN 3005 Concentrator 3.6.7 D Cisco VPN 3005 Concentrator 3.6.7 C Cisco VPN 3005 Concentrator 3.6.7 B Cisco VPN 3005 Concentrator 3.6.7 A Cisco VPN 3005 Concentrator 3.6.7 Cisco VPN 3005 Concentrator 3.6.5 Cisco VPN 3005 Concentrator 3.6.3 Cisco VPN 3005 Concentrator 4.7 REL Cisco VPN 3002 Hardware Client Cisco VPN 3001 Concentrator 0 Cisco VPN 3000 Concentrator 4.7.2 G Cisco VPN 3000 Concentrator 4.7.2 Cisco VPN 3000 Concentrator 4.7.1 F Cisco VPN 3000 Concentrator 4.7.1 Cisco VPN 3000 Concentrator 4.7 Cisco VPN 3000 Concentrator 4.1.7 M Cisco VPN 3000 Concentrator 4.1.5 .B Cisco VPN 3000 Concentrator 4.1 .x Cisco VPN 3000 Concentrator 4.0.5 .B Cisco VPN 3000 Concentrator 4.0.1 Cisco VPN 3000 Concentrator 4.0 .x Cisco VPN 3000 Concentrator 4.0 Cisco VPN 3000 Concentrator 3.6.7 D Cisco VPN 3000 Concentrator 3.6.7 Cisco VPN 3000 Concentrator 3.6.1 Cisco VPN 3000 Concentrator 3.6 Cisco VPN 3000 Concentrator 3.5.5 Cisco VPN 3000 Concentrator 3.5.4 Cisco VPN 3000 Concentrator 3.5.3 Cisco VPN 3000 Concentrator 3.5.2 Cisco VPN 3000 Concentrator 3.5.1 Cisco VPN 3000 Concentrator 3.5 (Rel) Cisco VPN 3000 Concentrator 3.1.4 Cisco VPN 3000 Concentrator 3.1.2 Cisco VPN 3000 Concentrator 3.1.1 Cisco VPN 3000 Concentrator 3.1 (Rel) Cisco VPN 3000 Concentrator 3.1 Cisco VPN 3000 Concentrator 3.0.4 Cisco VPN 3000 Concentrator 3.0.3 (B) Cisco VPN 3000 Concentrator 3.0.3 (A) Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 2.5.2 (F) Cisco VPN 3000 Concentrator 2.5.2 (D) Cisco VPN 3000 Concentrator 2.5.2 (C) Cisco VPN 3000 Concentrator 2.5.2 (B) Cisco VPN 3000 Concentrator 2.5.2 (A) Cisco VPN 3000 Concentrator 2.0 Cisco VPN 3000 Concentrator 4.1.7.B Cisco VPN 3000 Concentrator 4.1.7.A Cisco PIX 500 Series Security Appliance 7.1 Cisco PIX 500 Series Security Appliance 7.0(4) Cisco PIX 500 Series Security Appliance 7.0 Cisco ASA 5500 Series Adaptive Security Appliance 8.2.2 Cisco ASA 5500 Series Adaptive Security Appliance 7.0.4 .3 Cisco ASA 5500 Series Adaptive Security Appliance 7.0.4 Cisco ASA 5500 Series Adaptive Security Appliance 7.0 Cisco ASA 5500 Series Adaptive Security Appliance 8.3(1.6) Cisco ASA 5500 Series Adaptive Security Appliance 8.3(1.1) Cisco ASA 5500 Series Adaptive Security Appliance 8.3(0.08) Cisco ASA 5500 Series Adaptive Security Appliance 8.3 Cisco ASA 5500 Series Adaptive Security Appliance 8.2(2.17) Cisco ASA 5500 Series Adaptive Security Appliance 8.2(2.13) Cisco ASA 5500 Series Adaptive Security Appliance 8.2(2.10) Cisco ASA 5500 Series Adaptive Security Appliance 8.2(2.1) Cisco ASA 5500 Series Adaptive Security Appliance 8.2(2) Cisco ASA 5500 Series Adaptive Security Appliance 8.2(1.5) Cisco ASA 5500 Series Adaptive Security Appliance 8.2(1.2) Cisco ASA 5500 Series Adaptive Security Appliance 8.2(1.16) Cisco ASA 5500 Series Adaptive Security Appliance 8.2(1.15) Cisco ASA 5500 Series Adaptive Security Appliance 8.2(1.10) Cisco ASA 5500 Series Adaptive Security Appliance 8.2 Cisco ASA 5500 Series Adaptive Security Appliance 8.1(2.46) Cisco ASA 5500 Series Adaptive Security Appliance 8.1(2.45) Cisco ASA 5500 Series Adaptive Security Appliance 8.1(2.44) Cisco ASA 5500 Series Adaptive Security Appliance 8.1(2.40) Cisco ASA 5500 Series Adaptive Security Appliance 8.1(2.39) Cisco ASA 5500 Series Adaptive Security Appliance 8.1(2.37) Cisco ASA 5500 Series Adaptive Security Appliance 8.1(2.35) Cisco ASA 5500 Series Adaptive Security Appliance 8.1(2.29) Cisco ASA 5500 Series Adaptive Security Appliance 8.1 Cisco ASA 5500 Series Adaptive Security Appliance 8.0(5.7) Cisco ASA 5500 Series Adaptive Security Appliance 8.0(5.6) Cisco ASA 5500 Series Adaptive Security Appliance 8.0(5.2) Cisco ASA 5500 Series Adaptive Security Appliance 8.0(5.19) Cisco ASA 5500 Series Adaptive Security Appliance 8.0(5.17) Cisco ASA 5500 Series Adaptive Security Appliance 8.0(5.15) Cisco ASA 5500 Series Adaptive Security Appliance 8.0(5.1) Cisco ASA 5500 Series Adaptive Security Appliance 8.0(4.44) Cisco ASA 5500 Series Adaptive Security Appliance 8.0(4.38) Cisco ASA 5500 Series Adaptive Security Appliance 8.0 Cisco ASA 5500 Series Adaptive Security Appliance 7.2(5) Cisco ASA 5500 Series Adaptive Security Appliance 7.2(4.46) Cisco ASA 5500 Series Adaptive Security Appliance 7.2(4.45) Cisco ASA 5500 Series Adaptive Security Appliance 7.2(4.44) Cisco ASA 5500 Series Adaptive Security Appliance 7.2 Cisco ASA 5500 Series Adaptive Security Appliance 7.1 Cisco ASA 5500 Series Adaptive Security Appliance 7.0(8.11) Cisco ASA 5500 Series Adaptive Security Appliance 7.0(8.10) Cisco ASA 5500 Series Adaptive Security Appliance 7.0 Cisco Adaptive Security Appliance 8.2.1 3 Cisco Adaptive Security Appliance 8.2.1 Cisco Adaptive Security Appliance 8.1.2 Cisco Adaptive Security Appliance 8.0.2 11 Cisco Adaptive Security Appliance 7.0 (4) Cisco Adaptive Security Appliance 7.0 (2) Cisco Adaptive Security Appliance 7.0 (0) Cisco Adaptive Security Appliance 8.1.2.25 Cisco Adaptive Security Appliance 8.1(2)19 Cisco Adaptive Security Appliance 8.1 (2)14 Cisco Adaptive Security Appliance 8.0.4.34 Cisco Adaptive Security Appliance 8.0(4) Cisco Adaptive Security Appliance 8.0 Cisco Adaptive Security Appliance 7.2.2.34 Cisco Adaptive Security Appliance 7.2 Cisco Adaptive Security Appliance 7.1.2.61 Cisco Adaptive Security Appliance 7.1 Cisco Adaptive Security Appliance 7.0.7.1 Cisco Adaptive Security Appliance 7.0 Cisco Adaptive Security Appliance 0 |
| Not Vulnerable: | |
Discussion
Cisco IPSec VPN Groupname Enumeration Weakness
Cisco IPSec VPN is prone to a remote groupname enumeration weakness.
Attackers can exploit this issue to discover valid group names that may be used in group-based authentication. Successful exploits can aid the attacker in launching man-in-the-middle attacks against the affected device.
This issue is tracked by Cisco Bug ID CSCtj96108.
The following devices are affected:
ASA 5500 series Adaptive Security Appliance
PIX 500 series Security Appliance
VPN 3000 series concentrators (3005, 3015, 3020, 3030, 3060, and 3080 models)
Cisco IPSec VPN is prone to a remote groupname enumeration weakness.
Attackers can exploit this issue to discover valid group names that may be used in group-based authentication. Successful exploits can aid the attacker in launching man-in-the-middle attacks against the affected device.
This issue is tracked by Cisco Bug ID CSCtj96108.
The following devices are affected:
ASA 5500 series Adaptive Security Appliance
PIX 500 series Security Appliance
VPN 3000 series concentrators (3005, 3015, 3020, 3030, 3060, and 3080 models)
Exploit / POC
Cisco IPSec VPN Groupname Enumeration Weakness
Attackers can exploit this issue with readily available tools.
Attackers can exploit this issue with readily available tools.
Solution / Fix
Cisco IPSec VPN Groupname Enumeration Weakness
Solution:
Updates are available; please see the references for more information.
Solution:
Updates are available; please see the references for more information.
References
Cisco IPSec VPN Groupname Enumeration Weakness
References:
References: