Cisco VPN 3000 Series Concentrator Posted User Credential Denial Of Service Vulnerability
BID:5617
Info
Cisco VPN 3000 Series Concentrator Posted User Credential Denial Of Service Vulnerability
| Bugtraq ID: | 5617 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2002-1100 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 03 2002 12:00AM |
| Updated: | Jul 11 2009 03:56PM |
| Credit: | Vulnerability announced in a Cisco Security Advisory. |
| Vulnerable: |
Cisco VPN 3002 Hardware Client Cisco VPN 3000 Concentrator 3.5.2 Cisco VPN 3000 Concentrator 3.5.1 Cisco VPN 3000 Concentrator 3.5 (Rel) Cisco VPN 3000 Concentrator 3.1.4 Cisco VPN 3000 Concentrator 3.1.2 Cisco VPN 3000 Concentrator 3.1.1 Cisco VPN 3000 Concentrator 3.1 (Rel) Cisco VPN 3000 Concentrator 3.1 Cisco VPN 3000 Concentrator 3.0.4 Cisco VPN 3000 Concentrator 3.0.3 (B) Cisco VPN 3000 Concentrator 3.0.3 (A) Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 2.5.2 (F) Cisco VPN 3000 Concentrator 2.5.2 (D) Cisco VPN 3000 Concentrator 2.5.2 (C) Cisco VPN 3000 Concentrator 2.5.2 (B) Cisco VPN 3000 Concentrator 2.5.2 (A) Cisco VPN 3000 Concentrator 2.0 |
| Not Vulnerable: |
Cisco VPN 3000 Concentrator 3.6.1 Cisco VPN 3000 Concentrator 3.6 Cisco VPN 3000 Concentrator 3.5.5 Cisco VPN 3000 Concentrator 3.5.4 Cisco VPN 3000 Concentrator 3.5.3 |
Discussion
Cisco VPN 3000 Series Concentrator Posted User Credential Denial Of Service Vulnerability
Cisco VPN 3000 series concentrators are prone to a denial of service condition when handling overly long username/password strings via login pages for the web interface of the device. To exploit this condition, the attacker must submit overly long values for the username/password strings using the POST method. The attacker might, for example, submit a modified version of the form for the login page to trigger this condition.
Successful exploitation will cause the device to reload.
Cisco VPN 3000 series concentrators are prone to a denial of service condition when handling overly long username/password strings via login pages for the web interface of the device. To exploit this condition, the attacker must submit overly long values for the username/password strings using the POST method. The attacker might, for example, submit a modified version of the form for the login page to trigger this condition.
Successful exploitation will cause the device to reload.
Exploit / POC
Cisco VPN 3000 Series Concentrator Posted User Credential Denial Of Service Vulnerability
There is no exploit code required. This may be exploited using a text editor and a web browser. It may also be exploited using a web client that has the capability of submitting custom form data manually.
There is no exploit code required. This may be exploited using a text editor and a web browser. It may also be exploited using a web client that has the capability of submitting custom form data manually.
Solution / Fix
Cisco VPN 3000 Series Concentrator Posted User Credential Denial Of Service Vulnerability
Solution:
Cisco has released fixes which address this issue. For Cisco VPN 3002 Hardware Client, this issue is addressed in versions 3.5.5 and 3.6.1 of the firmware.
Cisco VPN 3000 Concentrator 3.5 (Rel)
Cisco VPN 3000 Concentrator 3.5.1
Cisco VPN 3000 Concentrator 3.5.2
Solution:
Cisco has released fixes which address this issue. For Cisco VPN 3002 Hardware Client, this issue is addressed in versions 3.5.5 and 3.6.1 of the firmware.
Cisco VPN 3000 Concentrator 3.5 (Rel)
-
Cisco VPN 3000 Concentrator 3.5.3
http://www.cisco.com/tac
Cisco VPN 3000 Concentrator 3.5.1
-
Cisco VPN 3000 Concentrator 3.5.3
http://www.cisco.com/tac
Cisco VPN 3000 Concentrator 3.5.2
-
Cisco VPN 3000 Concentrator 3.5.3
http://www.cisco.com/tac
References
Cisco VPN 3000 Series Concentrator Posted User Credential Denial Of Service Vulnerability
References:
References: