Cisco VPN 3000 Concentrator IPSEC Tunnel Denial of Service Vulnerability
BID:5622
Info
Cisco VPN 3000 Concentrator IPSEC Tunnel Denial of Service Vulnerability
| Bugtraq ID: | 5622 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 03 2002 12:00AM |
| Updated: | Sep 03 2002 12:00AM |
| Credit: | Vulnerability announced in a Cisco Security Advisory. |
| Vulnerable: |
Cisco VPN 3002 Hardware Client Cisco VPN 3000 Concentrator 3.5.3 Cisco VPN 3000 Concentrator 3.5.2 Cisco VPN 3000 Concentrator 3.5.1 Cisco VPN 3000 Concentrator 3.5 (Rel) Cisco VPN 3000 Concentrator 3.1.4 Cisco VPN 3000 Concentrator 3.1.2 Cisco VPN 3000 Concentrator 3.1.1 Cisco VPN 3000 Concentrator 3.1 (Rel) Cisco VPN 3000 Concentrator 3.1 Cisco VPN 3000 Concentrator 3.0.4 Cisco VPN 3000 Concentrator 3.0.3 (B) Cisco VPN 3000 Concentrator 3.0.3 (A) Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 2.5.2 (F) Cisco VPN 3000 Concentrator 2.5.2 (D) Cisco VPN 3000 Concentrator 2.5.2 (C) Cisco VPN 3000 Concentrator 2.5.2 (B) Cisco VPN 3000 Concentrator 2.5.2 (A) Cisco VPN 3000 Concentrator 2.0 |
| Not Vulnerable: |
Cisco VPN 3000 Concentrator 3.6.1 Cisco VPN 3000 Concentrator 3.6 Cisco VPN 3000 Concentrator 3.5.5 Cisco VPN 3000 Concentrator 3.5.4 |
Discussion
Cisco VPN 3000 Concentrator IPSEC Tunnel Denial of Service Vulnerability
Cisco has reported a security vulnerability in VPN 3000 series concentrator devices. The vulnerability is related to handling of incoming LAN-to-LAN IPSEC tunnel connections. When a connection is initiated on behalf of a remote network for which the device already has a security association, the existing connection is terminated. According to Cisco, this behaviour may be exploitable as a denial of service attack.
Furthermore, affected devices do not ensure that the data transmitted across a LAN-to-LAN IPSEC tunnel is sourced from the appropriate network. The implications of this potentially separate issue are not yet known.
Cisco has reported a security vulnerability in VPN 3000 series concentrator devices. The vulnerability is related to handling of incoming LAN-to-LAN IPSEC tunnel connections. When a connection is initiated on behalf of a remote network for which the device already has a security association, the existing connection is terminated. According to Cisco, this behaviour may be exploitable as a denial of service attack.
Furthermore, affected devices do not ensure that the data transmitted across a LAN-to-LAN IPSEC tunnel is sourced from the appropriate network. The implications of this potentially separate issue are not yet known.
Exploit / POC
Cisco VPN 3000 Concentrator IPSEC Tunnel Denial of Service Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Cisco VPN 3000 Concentrator IPSEC Tunnel Denial of Service Vulnerability
Solution:
Cisco has released fixes which address this issue. For Cisco VPN 3002 Hardware Client, this issue is addressed in versions 3.5.5 and 3.6.1 of the firmware.
Cisco VPN 3000 Concentrator 3.5 (Rel)
Cisco VPN 3000 Concentrator 3.5.1
Cisco VPN 3000 Concentrator 3.5.2
Cisco VPN 3000 Concentrator 3.5.3
Solution:
Cisco has released fixes which address this issue. For Cisco VPN 3002 Hardware Client, this issue is addressed in versions 3.5.5 and 3.6.1 of the firmware.
Cisco VPN 3000 Concentrator 3.5 (Rel)
-
Cisco VPN 3000 Concentrator 3.5.4
http://www.cisco.com/tac
Cisco VPN 3000 Concentrator 3.5.1
-
Cisco VPN 3000 Concentrator 3.5.4
http://www.cisco.com/tac
Cisco VPN 3000 Concentrator 3.5.2
-
Cisco VPN 3000 Concentrator 3.5.4
http://www.cisco.com/tac
Cisco VPN 3000 Concentrator 3.5.3
-
Cisco VPN 3000 Concentrator 3.5.4
http://www.cisco.com/tac
References
Cisco VPN 3000 Concentrator IPSEC Tunnel Denial of Service Vulnerability
References:
References: