Multiple Vendor VPN Implementation Vulnerabilities

Bugtraq ID:	8676
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 22 2003 12:00AM
Updated:	Sep 22 2003 12:00AM
Credit:	The discovery of these vulnerabilities has been credited to Peter Gutmann.
Vulnerable:	VTun VTun 2.6 VTun VTun 2.5 b1 VTun VTun 2.5 VTun VTun 2.4 VTun VTun 2.3 VTun VTun 2.2 VTun VTun 2.1 VTun VTun 2.0 tinc tinc 1.0.1 tinc tinc 1.0 pre5 tinc tinc 1.0 pre4 tinc tinc 1.0 pre3 tinc tinc 1.0 Olaf Titz CIPE 1.5.4 Olaf Titz CIPE 1.5.3 Olaf Titz CIPE 1.5.2 + MandrakeSoft Corporate Server 1.0.1 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 Olaf Titz CIPE 1.4.6 Olaf Titz CIPE 1.4.5 Olaf Titz CIPE 1.3 Olaf Titz CIPE 1.2 Olaf Titz CIPE 1.1 Olaf Titz CIPE 1.0.1
Not Vulnerable:

Multiple Vendor VPN Implementation Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Multiple Vendor VPN Implementation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Multiple Vendor VPN Implementation Vulnerabilities

References:

• CIPE Homepage (Olaf Titz)
  
• Linux's answer to MS-PPTP (Peter Gutmann)
  
• Re: What do you guys think about this? (Hans Steegers)
  
• tinc Homepage (tinc)
  
• VTun Homepage (VTun)
  
• My response to both the analysis of CIPE by Gutmann, Slashdot andthe response by (Jake Appelbaum )