Cisco VPN Client Distinguished Name Validation Vulnerability

Bugtraq ID:	5652
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 05 2002 12:00AM
Updated:	Sep 05 2002 12:00AM
Credit:	This issue was announced in a Cisco Security Advisory.
Vulnerable:	Cisco VPN Client for Windows 3.5.1 Cisco VPN Client for Windows 3.1 Cisco VPN Client for Windows 3.0.5 Cisco VPN Client for Windows 3.0 Cisco VPN Client for Windows 2.0 Cisco VPN Client for Solaris 3.5.1 Cisco VPN Client for Mac OS X 3.5.1 Cisco VPN Client for Linux 3.5.1
Not Vulnerable:	Cisco VPN Client for Windows 3.6 (Rel) Cisco VPN Client for Windows 3.5.1 C

Cisco VPN Client Distinguished Name Validation Vulnerability

A flaw in the Cisco VPN Client prevents the client from sufficiently validating credentials supplied in a certificate used for VPN privacy. The client does not properly validate Distinguished Names (DN) contained in some certificates, and may trust certificates supplied by a third party that represent a malicious host.

Cisco VPN Client Distinguished Name Validation Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Cisco VPN Client Distinguished Name Validation Vulnerability

Solution:
Users are advised to upgrade to versions 3.5.1C and later.


Cisco VPN Client for Windows 3.5.1

• Cisco VPN Client 3.5.1C
  

Cisco VPN Client for Linux 3.5.1

• Cisco VPN Client 3.5.1C
  

Cisco VPN Client for Mac OS X 3.5.1

• Cisco VPN Client 3.5.1C
  

Cisco VPN Client for Solaris 3.5.1

• Cisco VPN Client 3.5.1C
  

Cisco VPN Client Distinguished Name Validation Vulnerability

References:

• Cisco VPN Client Multiple Vulnerabilities - Second Set (Cisco)