Cisco HTTP Interface Long Request Denial Of Service Vulnerability
BID:5615
Info
Cisco HTTP Interface Long Request Denial Of Service Vulnerability
| Bugtraq ID: | 5615 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2002-1093 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 03 2002 12:00AM |
| Updated: | Jul 11 2009 03:56PM |
| Credit: | Vulnerability announced in a Cisco Security Advisory. |
| Vulnerable: |
Cisco VPN 3000 Concentrator 3.0.3 (A) Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 2.5.2 (F) Cisco VPN 3000 Concentrator 2.5.2 (D) Cisco VPN 3000 Concentrator 2.5.2 (C) Cisco VPN 3000 Concentrator 2.5.2 (B) Cisco VPN 3000 Concentrator 2.5.2 (A) Cisco VPN 3000 Concentrator 2.0 |
| Not Vulnerable: |
Cisco VPN 3000 Concentrator 3.6.1 Cisco VPN 3000 Concentrator 3.6 Cisco VPN 3000 Concentrator 3.5.5 Cisco VPN 3000 Concentrator 3.5.4 Cisco VPN 3000 Concentrator 3.5.3 Cisco VPN 3000 Concentrator 3.5.2 Cisco VPN 3000 Concentrator 3.5.1 Cisco VPN 3000 Concentrator 3.5 (Rel) Cisco VPN 3000 Concentrator 3.1.4 Cisco VPN 3000 Concentrator 3.1.2 Cisco VPN 3000 Concentrator 3.1.1 Cisco VPN 3000 Concentrator 3.1 (Rel) Cisco VPN 3000 Concentrator 3.0.4 Cisco VPN 3000 Concentrator 3.0.3 (B) |
Discussion
Cisco HTTP Interface Long Request Denial Of Service Vulnerability
Cisco VPN 3000 series concentrators are a family of products for
facilitating secure communications via VPN (Virtual Private Networks).
It has been discovered that under some circumstances, it is possible to cause a resource consumption issue on a VPN Concentrator that can result in a denial of service. By placing a malicious HTTP request to a vulnerable system, the system becomes unstable.
Cisco VPN 3000 series concentrators are a family of products for
facilitating secure communications via VPN (Virtual Private Networks).
It has been discovered that under some circumstances, it is possible to cause a resource consumption issue on a VPN Concentrator that can result in a denial of service. By placing a malicious HTTP request to a vulnerable system, the system becomes unstable.
Exploit / POC
Cisco HTTP Interface Long Request Denial Of Service Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Cisco HTTP Interface Long Request Denial Of Service Vulnerability
Solution:
Cisco has released fixes which address this issue. For Cisco VPN 3002 Hardware Client, this issue is addressed in versions 3.5.5 and 3.6.1 of the firmware.
Cisco VPN 3000 Concentrator 3.0
Cisco VPN 3000 Concentrator 3.0
Cisco VPN 3000 Concentrator 3.0.3 (A)
Solution:
Cisco has released fixes which address this issue. For Cisco VPN 3002 Hardware Client, this issue is addressed in versions 3.5.5 and 3.6.1 of the firmware.
Cisco VPN 3000 Concentrator 3.0
-
Cisco VPN 3000 Concentrator 3.0.3(B)
http://www.cisco.com/tac
Cisco VPN 3000 Concentrator 3.0
-
Cisco VPN 3000 Concentrator 3.0.3(B)
http://www.cisco.com/tac
Cisco VPN 3000 Concentrator 3.0.3 (A)
-
Cisco VPN 3000 Concentrator 3.0.3(B)
http://www.cisco.com/tac
References
Cisco HTTP Interface Long Request Denial Of Service Vulnerability
References:
References: