Cisco VPN Client for Unix Local Buffer Overflow Vulnerability
BID:5056
Info
Cisco VPN Client for Unix Local Buffer Overflow Vulnerability
| Bugtraq ID: | 5056 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2002-1447 |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 19 2002 12:00AM |
| Updated: | Jul 11 2009 01:56PM |
| Credit: | Discovered by methodic <[email protected]> and Josha Bronson. |
| Vulnerable: |
Cisco VPN Client for Solaris 3.5.1 Cisco VPN Client for Mac OS X 3.5.1 Cisco VPN Client for Linux 3.5.1 |
| Not Vulnerable: |
Cisco VPN Client for Solaris 3.5.2 Cisco VPN Client for Mac OS X 3.5.2 Cisco VPN Client for Linux 3.5.2 |
Discussion
Cisco VPN Client for Unix Local Buffer Overflow Vulnerability
The Cisco VPN Client software is used to establish Virtual Private Network (VPN) connections between client machines and a Cisco VPN Concentrator.
A vulnerability has been reported in some versions of the VPN Client. If an oversized profile name is passed to the vpnclient binary, a buffer overflow condition may occur. As vpnclient runs suid root, exploitation of this vulnerability will grant a local attacker root access to the vulnerable system.
This vulnerability affects the VPN Client version 3.5.1 for Linux, Solaris and Mac OS X. Windows clients are not believed to be vulnerable. Earlier versions of the VPN Client may share this vulnerability, although this has not been confirmed.
The Cisco VPN Client software is used to establish Virtual Private Network (VPN) connections between client machines and a Cisco VPN Concentrator.
A vulnerability has been reported in some versions of the VPN Client. If an oversized profile name is passed to the vpnclient binary, a buffer overflow condition may occur. As vpnclient runs suid root, exploitation of this vulnerability will grant a local attacker root access to the vulnerable system.
This vulnerability affects the VPN Client version 3.5.1 for Linux, Solaris and Mac OS X. Windows clients are not believed to be vulnerable. Earlier versions of the VPN Client may share this vulnerability, although this has not been confirmed.