Cisco VPN Client IKE Security Parameter Index Payload Buffer Overflow Vulnerability
BID:5441
Info
Cisco VPN Client IKE Security Parameter Index Payload Buffer Overflow Vulnerability
| Bugtraq ID: | 5441 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 12 2002 12:00AM |
| Updated: | Aug 12 2002 12:00AM |
| Credit: | Published in a Cisco Security Advisory. CERT/CC credits Anton Rager of Avaya Communications with discovery. |
| Vulnerable: |
Cisco VPN Client for Windows 3.5.2 Cisco VPN Client for Windows 3.5.1 Cisco VPN Client for Solaris 3.5.2 Cisco VPN Client for Solaris 3.5.1 Cisco VPN Client for Mac OS X 3.5.2 Cisco VPN Client for Mac OS X 3.5.1 Cisco VPN Client for Linux 3.5.2 Cisco VPN Client for Linux 3.5.1 |
| Not Vulnerable: |
Cisco VPN Client for Windows 3.6 Cisco VPN Client for Solaris 3.6 Cisco VPN Client for Mac OS X 3.6 Cisco VPN Client for Linux 3.6 |
Discussion
Cisco VPN Client IKE Security Parameter Index Payload Buffer Overflow Vulnerability
The Cisco VPN Client is prone to a remotely exploitable buffer overflow condition. It is possible to trigger this condition by sending malformed IKE packets to the client. The overflow occurs when the Security Parameter Index payload of the IKE packet is longer than 16 bytes in length.
It may be possible to exploit this condition to execute arbitrary code with the privileges of the client. It is possible that exploitation of this vulnerability may affect availability of the client, resulting in a denial of service condition.
This issue is reported to be exploitable when the client software is operating in Aggressive Mode during a phase 1 IKE exchange.
This vulnerability affects versions of the client on all platforms.
The Cisco VPN Client is prone to a remotely exploitable buffer overflow condition. It is possible to trigger this condition by sending malformed IKE packets to the client. The overflow occurs when the Security Parameter Index payload of the IKE packet is longer than 16 bytes in length.
It may be possible to exploit this condition to execute arbitrary code with the privileges of the client. It is possible that exploitation of this vulnerability may affect availability of the client, resulting in a denial of service condition.
This issue is reported to be exploitable when the client software is operating in Aggressive Mode during a phase 1 IKE exchange.
This vulnerability affects versions of the client on all platforms.
Exploit / POC
Cisco VPN Client IKE Security Parameter Index Payload Buffer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Cisco VPN Client IKE Security Parameter Index Payload Buffer Overflow Vulnerability
Solution:
This vulnerability has been fixed in Cisco VPN Client version 3.6. Fixes for this issue will be integrated into VPN Client version 3.5.4 or later, which is reported to be available for download by September 30, 2002. Customers may obtain upgrades through their regular channels, such as the Cisco's Software Center:
http://www.cisco.com/kobayashi/sw-center/
Solution:
This vulnerability has been fixed in Cisco VPN Client version 3.6. Fixes for this issue will be integrated into VPN Client version 3.5.4 or later, which is reported to be available for download by September 30, 2002. Customers may obtain upgrades through their regular channels, such as the Cisco's Software Center:
http://www.cisco.com/kobayashi/sw-center/
References
Cisco VPN Client IKE Security Parameter Index Payload Buffer Overflow Vulnerability
References:
References:
- Vulnerability Note VU#287771 (CERT/CC)