BID:6211

Cisco PIX VPN Session Hijacking Vulnerability

Info

Cisco PIX VPN Session Hijacking Vulnerability

Bugtraq ID:	6211
Class:	Origin Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 20 2002 12:00AM
Updated:	Nov 20 2002 12:00AM
Credit:	Vulnerability announced in a Cisco Security Advisory.
Vulnerable:	Cisco PIX Firewall 6.1.3 Cisco PIX Firewall 6.1 (2) Cisco PIX Firewall 6.1 + Cisco PIX Firewall 515 + Cisco PIX Firewall 520 Cisco PIX Firewall 6.0.3 Cisco PIX Firewall 6.0 (2) Cisco PIX Firewall 6.0 (1) Cisco PIX Firewall 6.0 + Cisco PIX Firewall 515 + Cisco PIX Firewall 520

Not Vulnerable:	Cisco PIX Firewall 6.2.1 Cisco PIX Firewall 6.1.4 Cisco PIX Firewall 6.0.4

Discussion

Cisco PIX VPN Session Hijacking Vulnerability

PIX is the firewall system/firmware combination distributed and maintained by Cisco Systems.

A vulnerability has been discovered in the handling of VPN sessions by PIX firewalls. Due to insecure handling of sessions through the Internet Security Authentication Key Management Protocol (ISAKMP) Security Associations (SAs) implemented by PIX firewalls, it is possible for a user to hijack the session of another. This could result in users gaining unintended access to private networks.

The attacker must already have access to the peer authentication key to initiate this type of attack.

Exploit / POC

Cisco PIX VPN Session Hijacking Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.