Cisco VPN 3000 Series Concentrator XML Filter Misconfigured Access Vulnerability
BID:5614
Info
Cisco VPN 3000 Series Concentrator XML Filter Misconfigured Access Vulnerability
| Bugtraq ID: | 5614 |
| Class: | Design Error |
| CVE: |
CVE-2002-1098 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 03 2002 12:00AM |
| Updated: | Jul 11 2009 03:56PM |
| Credit: | Vulnerability announced in a Cisco Security Advisory. |
| Vulnerable: |
Cisco VPN 3002 Hardware Client Cisco VPN 3000 Concentrator 3.5.2 Cisco VPN 3000 Concentrator 3.5.1 Cisco VPN 3000 Concentrator 3.5 (Rel) Cisco VPN 3000 Concentrator 3.1.4 Cisco VPN 3000 Concentrator 3.1.2 Cisco VPN 3000 Concentrator 3.1.1 Cisco VPN 3000 Concentrator 3.1 (Rel) Cisco VPN 3000 Concentrator 3.1 Cisco VPN 3000 Concentrator 3.0.4 Cisco VPN 3000 Concentrator 3.0.3 (B) Cisco VPN 3000 Concentrator 3.0.3 (A) Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 2.5.2 (F) Cisco VPN 3000 Concentrator 2.5.2 (D) Cisco VPN 3000 Concentrator 2.5.2 (C) Cisco VPN 3000 Concentrator 2.5.2 (B) Cisco VPN 3000 Concentrator 2.5.2 (A) Cisco VPN 3000 Concentrator 2.0 |
| Not Vulnerable: |
Cisco VPN 3000 Concentrator 3.6.1 Cisco VPN 3000 Concentrator 3.6 Cisco VPN 3000 Concentrator 3.5.5 Cisco VPN 3000 Concentrator 3.5.4 Cisco VPN 3000 Concentrator 3.5.3 |
Discussion
Cisco VPN 3000 Series Concentrator XML Filter Misconfigured Access Vulnerability
Cisco VPN 3000 series concentrators are prone to an issue with XML filters which may inadvertently allow unauthorized network access to occur. This issue occurs when XML filters have been enabled on the public interface of the device. When an XML filter is added, the following rule is created:
"HTTPS on Public Inbound (XML-Auto)(forward/in)"
The protocol is mistakenly set to "ANY" and the value for the destination port is set to 443. The vulnerable concentrator checks the destination port only when the value for the protocol is set to "TCP" or "UDP". Since the protocol is mistakenly set to "ANY", this will allow network connections using any protocol to an arbitrary port to occur through the concentrator.
Cisco VPN 3000 series concentrators are prone to an issue with XML filters which may inadvertently allow unauthorized network access to occur. This issue occurs when XML filters have been enabled on the public interface of the device. When an XML filter is added, the following rule is created:
"HTTPS on Public Inbound (XML-Auto)(forward/in)"
The protocol is mistakenly set to "ANY" and the value for the destination port is set to 443. The vulnerable concentrator checks the destination port only when the value for the protocol is set to "TCP" or "UDP". Since the protocol is mistakenly set to "ANY", this will allow network connections using any protocol to an arbitrary port to occur through the concentrator.
Exploit / POC
Cisco VPN 3000 Series Concentrator XML Filter Misconfigured Access Vulnerability
There is no exploit code required.
There is no exploit code required.
Solution / Fix
Cisco VPN 3000 Series Concentrator XML Filter Misconfigured Access Vulnerability
Solution:
Cisco has released fixes which address this issue. For Cisco VPN 3002 Hardware Client, this issue is addressed in versions 3.5.5 and 3.6.1 of the firmware.
Cisco VPN 3000 Concentrator 3.5 (Rel)
Cisco VPN 3000 Concentrator 3.5.1
Cisco VPN 3000 Concentrator 3.5.2
Solution:
Cisco has released fixes which address this issue. For Cisco VPN 3002 Hardware Client, this issue is addressed in versions 3.5.5 and 3.6.1 of the firmware.
Cisco VPN 3000 Concentrator 3.5 (Rel)
-
Cisco VPN 3000 Concentrator 3.5.3
http://www.cisco.com/tac
Cisco VPN 3000 Concentrator 3.5.1
-
Cisco VPN 3000 Concentrator 3.5.3
http://www.cisco.com/tac
Cisco VPN 3000 Concentrator 3.5.2
-
Cisco VPN 3000 Concentrator 3.5.3
http://www.cisco.com/tac
References
Cisco VPN 3000 Series Concentrator XML Filter Misconfigured Access Vulnerability
References:
References: