Cisco VPN Concentrator PPTP Client Remote Denial Of Service Vulnerability

Bugtraq ID:	5625
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2002-1095
Remote:	Yes
Local:	No
Published:	Sep 03 2002 12:00AM
Updated:	Jul 11 2009 03:56PM
Credit:	Vulnerability announced in a Cisco Security Advisory.
Vulnerable:	Cisco VPN 3002 Hardware Client Cisco VPN 3000 Concentrator 2.5.2 (D) Cisco VPN 3000 Concentrator 2.5.2 (C) Cisco VPN 3000 Concentrator 2.5.2 (B) Cisco VPN 3000 Concentrator 2.5.2 (A) Cisco VPN 3000 Concentrator 2.0 Cisco Secure ACS for Windows NT 2.6.3 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0
Not Vulnerable:	Cisco VPN 3000 Concentrator 3.6.1 Cisco VPN 3000 Concentrator 3.6 Cisco VPN 3000 Concentrator 3.5.5 Cisco VPN 3000 Concentrator 3.5.4 Cisco VPN 3000 Concentrator 3.5.3 Cisco VPN 3000 Concentrator 3.5.2 Cisco VPN 3000 Concentrator 3.5.1 Cisco VPN 3000 Concentrator 3.5 (Rel) Cisco VPN 3000 Concentrator 3.1.4 Cisco VPN 3000 Concentrator 3.1.2 Cisco VPN 3000 Concentrator 3.1.1 Cisco VPN 3000 Concentrator 3.1 (Rel) Cisco VPN 3000 Concentrator 3.0.4 Cisco VPN 3000 Concentrator 3.0.3 (B) Cisco VPN 3000 Concentrator 3.0.3 (A) Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 2.5.2 (F)

Cisco VPN Concentrator PPTP Client Remote Denial Of Service Vulnerability

Cisco VPN 3000 series concentrators are a family of products for
facilitating secure communications via VPN (Virtual Private Networks).

Under some circumstances, it may be possible for a remote PPTP client to cause a denial of service. By connecting to a vulnerable device with the "No Encryption" option specified in the client, the VPN Concentrator can be made to become unstable. This could result in a denial of service to legitimate users of the device.

Cisco VPN Concentrator PPTP Client Remote Denial Of Service Vulnerability

There is no exploit code required.

Cisco VPN Concentrator PPTP Client Remote Denial Of Service Vulnerability

Solution:
Cisco has released fixes which address this issue. For Cisco VPN 3002 Hardware Client, this issue is addressed in versions 3.5.5 and 3.6.1 of the firmware.


Cisco VPN 3000 Concentrator 2.5.2 (B)

• Cisco VPN 3000 Concentrator 2.5.2(F)
  http://www.cisco.com/public/sw-center/

Cisco VPN 3000 Concentrator 2.5.2 (C)

• Cisco VPN 3000 Concentrator 2.5.2(F)
  http://www.cisco.com/public/sw-center/

Cisco VPN 3000 Concentrator 2.5.2 (D)

• Cisco VPN 3000 Concentrator 2.5.2(F)
  http://www.cisco.com/public/sw-center/

Cisco VPN 3000 Concentrator 2.5.2 (A)

• Cisco VPN 3000 Concentrator 2.5.2(F)
  http://www.cisco.com/public/sw-center/

Cisco VPN Concentrator PPTP Client Remote Denial Of Service Vulnerability

References: