Cisco VPN Client TCP Filter Information Leakage Vulnerability
BID:5651
Info
Cisco VPN Client TCP Filter Information Leakage Vulnerability
| Bugtraq ID: | 5651 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 05 2002 12:00AM |
| Updated: | Sep 05 2002 12:00AM |
| Credit: | This issue was announced in a Cisco Security Advisory. |
| Vulnerable: |
Cisco VPN Client for Windows 3.6 (Rel) Cisco VPN Client for Windows 3.6 Cisco VPN Client for Windows 3.5.2 Cisco VPN Client for Windows 3.5.1 C Cisco VPN Client for Windows 3.5.1 Cisco VPN Client for Windows 3.1 Cisco VPN Client for Windows 3.0.5 Cisco VPN Client for Windows 3.0 Cisco VPN Client for Windows 2.0 Cisco VPN Client for Solaris 3.6 Cisco VPN Client for Solaris 3.5.2 Cisco VPN Client for Solaris 3.5.1 Cisco VPN Client for Mac OS X 3.6 Cisco VPN Client for Mac OS X 3.5.2 Cisco VPN Client for Mac OS X 3.5.1 Cisco VPN Client for Linux 3.6 Cisco VPN Client for Linux 3.5.2 Cisco VPN Client for Linux 3.5.1 |
| Not Vulnerable: |
Cisco VPN Client for Windows 3.6.1 Cisco VPN Client for Windows 3.5.4 Cisco VPN Client for Solaris 3.6.1 Cisco VPN Client for Solaris 3.5.4 Cisco VPN Client for Mac OS X 3.6.1 Cisco VPN Client for Mac OS X 3.5.4 Cisco VPN Client for Linux 3.6.1 Cisco VPN Client for Linux 3.5.4 |
Discussion
Cisco VPN Client TCP Filter Information Leakage Vulnerability
Cisco VPN Client, when running in "all tunnel mode", will acknowledge packets that originate from outside the tunnel. This has the potential to leak information about the client system to attackers.
This issue does not occur if "split tunneling mode" is enabled. Furthermore, 3.5.x releases of the client are not prone to this issue if the firewall is configured to run in "always on" mode. The 3.6(Rel) version of the client is prone to this issue even under circumstances where the firewall is run in "always on" mode.
Cisco VPN Client, when running in "all tunnel mode", will acknowledge packets that originate from outside the tunnel. This has the potential to leak information about the client system to attackers.
This issue does not occur if "split tunneling mode" is enabled. Furthermore, 3.5.x releases of the client are not prone to this issue if the firewall is configured to run in "always on" mode. The 3.6(Rel) version of the client is prone to this issue even under circumstances where the firewall is run in "always on" mode.
Exploit / POC
Cisco VPN Client TCP Filter Information Leakage Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Cisco VPN Client TCP Filter Information Leakage Vulnerability
Solution:
Users are advised to upgrade to version 3.5.4 or 3.6.1.
Cisco VPN Client for Windows 3.5.1
Cisco VPN Client for Windows 3.5.1 C
Cisco VPN Client for Linux 3.5.1
Cisco VPN Client for Mac OS X 3.5.1
Cisco VPN Client for Solaris 3.5.1
Cisco VPN Client for Windows 3.5.2
Cisco VPN Client for Solaris 3.5.2
Cisco VPN Client for Linux 3.5.2
Cisco VPN Client for Mac OS X 3.5.2
Cisco VPN Client for Windows 3.6 (Rel)
Cisco VPN Client for Solaris 3.6
Cisco VPN Client for Linux 3.6
Cisco VPN Client for Mac OS X 3.6
Cisco VPN Client for Windows 3.6
Solution:
Users are advised to upgrade to version 3.5.4 or 3.6.1.
Cisco VPN Client for Windows 3.5.1
Cisco VPN Client for Windows 3.5.1 C
Cisco VPN Client for Linux 3.5.1
Cisco VPN Client for Mac OS X 3.5.1
Cisco VPN Client for Solaris 3.5.1
Cisco VPN Client for Windows 3.5.2
Cisco VPN Client for Solaris 3.5.2
Cisco VPN Client for Linux 3.5.2
Cisco VPN Client for Mac OS X 3.5.2
Cisco VPN Client for Windows 3.6 (Rel)
Cisco VPN Client for Solaris 3.6
Cisco VPN Client for Linux 3.6
Cisco VPN Client for Mac OS X 3.6
Cisco VPN Client for Windows 3.6