Cisco Internal Group Authentication External Access Vulnerability

Bugtraq ID:	5613
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 03 2002 12:00AM
Updated:	Sep 03 2002 12:00AM
Credit:	Vulnerability announced in a Cisco Security Advisory.
Vulnerable:	Cisco VPN 3000 Concentrator 3.6 Cisco VPN 3000 Concentrator 3.5.4 Cisco VPN 3000 Concentrator 3.5.3 Cisco VPN 3000 Concentrator 3.5.2 Cisco VPN 3000 Concentrator 3.5.1 Cisco VPN 3000 Concentrator 3.5 (Rel) Cisco VPN 3000 Concentrator 3.1.2 Cisco VPN 3000 Concentrator 3.1.1 Cisco VPN 3000 Concentrator 3.1 (Rel) Cisco VPN 3000 Concentrator 3.1 Cisco VPN 3000 Concentrator 3.0.3 (A) Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 2.5.2 (F) Cisco VPN 3000 Concentrator 2.5.2 (D) Cisco VPN 3000 Concentrator 2.5.2 (C) Cisco VPN 3000 Concentrator 2.5.2 (B) Cisco VPN 3000 Concentrator 2.5.2 (A) Cisco VPN 3000 Concentrator 2.0
Not Vulnerable:	Cisco VPN 3002 Hardware Client Cisco VPN 3000 Concentrator 3.6.1 Cisco VPN 3000 Concentrator 3.5.5 Cisco VPN 3000 Concentrator 3.1.2 Cisco VPN 3000 Concentrator 3.0.4 Cisco VPN 3000 Concentrator 3.0.3 (B)

Cisco Internal Group Authentication External Access Vulnerability

Cisco VPN 3000 series concentrators are a family of products for facilitating secure communications via VPN (Virtual Private Networks).

It has been discovered that remote users can gain access to the network behind the VPN Concentrator through both IPSEC and PPTP through accounts that may not be intended for this type of access. By using a group account configured on the VPN Concentrator, remote users may access the network with group privileges afforded those on the network behind the VPN Concentrator. This could result in unintended privileges and access.

Cisco Internal Group Authentication External Access Vulnerability

There is no exploit code required.

Cisco Internal Group Authentication External Access Vulnerability

Solution:
The Cisco VPN 3002 Hardware Client does not support PPTP or incoming connections, and is thus not affected.

Cisco has released fixes which address this issue.


Cisco VPN 3000 Concentrator 3.0

• Cisco VPN 3000 Concentrator 3.0.3(B)
  http://www.cisco.com/tac

Cisco VPN 3000 Concentrator 3.0

• Cisco VPN 3000 Concentrator 3.0.3(B)
  http://www.cisco.com/tac

Cisco VPN 3000 Concentrator 3.0.3 (A)

• Cisco VPN 3000 Concentrator 3.0.3(B)
  http://www.cisco.com/tac

Cisco VPN 3000 Concentrator 3.1.1

• Cisco VPN 3000 Concentrator 3.1.2
  http://www.cisco.com/tac

Cisco VPN 3000 Concentrator 3.5 (Rel)

• Cisco VPN 3000 Concentrator 3.5.5
  http://www.cisco.com/tac

Cisco VPN 3000 Concentrator 3.5.3

• Cisco VPN 3000 Concentrator 3.5.5
  http://www.cisco.com/tac

Cisco VPN 3000 Concentrator 3.5.4

• Cisco VPN 3000 Concentrator 3.5.5
  http://www.cisco.com/tac

Cisco VPN 3000 Concentrator 3.6

• Cisco VPN 3000 Concentrator 3.6.1
  http://www.cisco.com/tac

Cisco Internal Group Authentication External Access Vulnerability

References: