Cisco VPN Client Password Disclosure Vulnerability

Bugtraq ID:	5650
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 05 2002 12:00AM
Updated:	Sep 05 2002 12:00AM
Credit:	Announced in a Cisco advisory.
Vulnerable:	Cisco VPN Client for Windows 3.5.1 Cisco VPN Client for Windows 3.1 Cisco VPN Client for Windows 3.0 Cisco VPN Client for Windows 2.0
Not Vulnerable:	Cisco VPN Client for Windows 3.6 (Rel) Cisco VPN Client for Windows 3.5.1 C

Cisco VPN Client Password Disclosure Vulnerability

Cisco has reported that a vulnerability exists in the Windows VPN client that may result in unintended disclosure of the password. It is possible to extract the plaintext password value from a "shaded" (replaced with asterisks) field in the authentication property page using a utility. This utility may be the publicly available "Revelation" tool, however this is unconfirmed.

Cisco VPN Client Password Disclosure Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Cisco VPN Client Password Disclosure Vulnerability

Solution:
Users are advised to upgrade to version 3.5.1C or 3.6(Rel).


Cisco VPN Client for Windows 3.5.1

• Cisco VPN Client 3.5.1C
  

Cisco VPN Client Password Disclosure Vulnerability

References:

• Cisco VPN Client Multiple Vulnerabilities - Second Set (Cisco)