Cisco VPN 3000 Series Concentrator Web Interface Information Disclosure Vulnerability
BID:5616
Info
Cisco VPN 3000 Series Concentrator Web Interface Information Disclosure Vulnerability
| Bugtraq ID: | 5616 |
| Class: | Access Validation Error |
| CVE: |
CVE-2002-1099 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 03 2002 12:00AM |
| Updated: | Jul 11 2009 03:56PM |
| Credit: | Vulnerability announced in a Cisco Security Advisory. |
| Vulnerable: |
Cisco VPN 3002 Hardware Client Cisco VPN 3000 Concentrator 3.5.2 Cisco VPN 3000 Concentrator 3.5.1 Cisco VPN 3000 Concentrator 3.5 (Rel) Cisco VPN 3000 Concentrator 3.1.4 Cisco VPN 3000 Concentrator 3.1.2 Cisco VPN 3000 Concentrator 3.1.1 Cisco VPN 3000 Concentrator 3.1 (Rel) Cisco VPN 3000 Concentrator 3.1 Cisco VPN 3000 Concentrator 3.0.4 Cisco VPN 3000 Concentrator 3.0.3 (B) Cisco VPN 3000 Concentrator 3.0.3 (A) Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 2.5.2 (F) Cisco VPN 3000 Concentrator 2.5.2 (D) Cisco VPN 3000 Concentrator 2.5.2 (C) Cisco VPN 3000 Concentrator 2.5.2 (B) Cisco VPN 3000 Concentrator 2.5.2 (A) Cisco VPN 3000 Concentrator 2.0 |
| Not Vulnerable: |
Cisco VPN 3000 Concentrator 3.6.1 Cisco VPN 3000 Concentrator 3.6 Cisco VPN 3000 Concentrator 3.5.5 Cisco VPN 3000 Concentrator 3.5.4 Cisco VPN 3000 Concentrator 3.5.3 |
Discussion
Cisco VPN 3000 Series Concentrator Web Interface Information Disclosure Vulnerability
Cisco VPN 3000 series concentrators leave some areas of the web interface exposed to unauthenticated web users. It has been reported that some of the exposed web pages may contain a limited amount of sensitive information which may potentially be of use to remote attackers.
Attackers may use the sensitive information disclosed in this manner to potentially aid in mounting further attacks against the device and the network.
Cisco VPN 3000 series concentrators leave some areas of the web interface exposed to unauthenticated web users. It has been reported that some of the exposed web pages may contain a limited amount of sensitive information which may potentially be of use to remote attackers.
Attackers may use the sensitive information disclosed in this manner to potentially aid in mounting further attacks against the device and the network.
Exploit / POC
Cisco VPN 3000 Series Concentrator Web Interface Information Disclosure Vulnerability
There is no exploit code required.
There is no exploit code required.
Solution / Fix
Cisco VPN 3000 Series Concentrator Web Interface Information Disclosure Vulnerability
Solution:
Cisco has released fixes which address this issue. For Cisco VPN 3002 Hardware Client, this issue is addressed in versions 3.5.5 and 3.6.1 of the firmware.
Cisco VPN 3000 Concentrator 3.5 (Rel)
Cisco VPN 3000 Concentrator 3.5.1
Cisco VPN 3000 Concentrator 3.5.2
Solution:
Cisco has released fixes which address this issue. For Cisco VPN 3002 Hardware Client, this issue is addressed in versions 3.5.5 and 3.6.1 of the firmware.
Cisco VPN 3000 Concentrator 3.5 (Rel)
-
Cisco VPN 3000 Concentrator 3.5.3
http://www.cisco.com/tac
Cisco VPN 3000 Concentrator 3.5.1
-
Cisco VPN 3000 Concentrator 3.5.3
http://www.cisco.com/tac
Cisco VPN 3000 Concentrator 3.5.2
-
Cisco VPN 3000 Concentrator 3.5.3
http://www.cisco.com/tac
References
Cisco VPN 3000 Series Concentrator Web Interface Information Disclosure Vulnerability
References:
References: