Multiple Vendor IKE Insecure XAUTH Implementation Vulnerabilities
BID:9209
Info
Multiple Vendor IKE Insecure XAUTH Implementation Vulnerabilities
| Bugtraq ID: | 9209 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 11 2003 12:00AM |
| Updated: | Dec 11 2003 12:00AM |
| Credit: | Discovery has been credited to Thor Lancelot Simon <[email protected]>. |
| Vulnerable: |
Cisco VPN Client for Windows 4.0.2 C Cisco VPN Client for Windows 4.0.2 A Cisco VPN Client for Windows 3.6.1 Cisco VPN Client for Windows 3.6 (Rel) Cisco VPN Client for Windows 3.6 Cisco VPN Client for Windows 3.5.4 Cisco VPN Client for Windows 3.5.2 B Cisco VPN Client for Windows 3.5.2 Cisco VPN Client for Windows 3.5.1 C Cisco VPN Client for Windows 3.5.1 Cisco VPN Client for Windows 3.1 Cisco VPN Client for Windows 3.0.5 Cisco VPN Client for Windows 3.0 Cisco VPN Client for Windows 2.0 Cisco VPN Client for Solaris 4.0.2 C Cisco VPN Client for Solaris 4.0.2 A Cisco VPN Client for Solaris 3.6.1 Cisco VPN Client for Solaris 3.6 Cisco VPN Client for Solaris 3.5.4 Cisco VPN Client for Solaris 3.5.2 B Cisco VPN Client for Solaris 3.5.2 Cisco VPN Client for Solaris 3.5.1 Cisco VPN Client for Mac OS X 4.0.2 C Cisco VPN Client for Mac OS X 4.0.2 A Cisco VPN Client for Mac OS X 3.6.1 Cisco VPN Client for Mac OS X 3.6 Cisco VPN Client for Mac OS X 3.5.4 Cisco VPN Client for Mac OS X 3.5.2 B Cisco VPN Client for Mac OS X 3.5.2 Cisco VPN Client for Mac OS X 3.5.1 Cisco VPN Client for Linux 3.6.1 Cisco VPN Client for Linux 3.6 Cisco VPN Client for Linux 3.5.4 Cisco VPN Client for Linux 3.5.2 B Cisco VPN Client for Linux 3.5.2 Cisco VPN Client for Linux 3.5.1 Cisco VPN 5000 Client for Solaris 5.2.8 Cisco VPN 5000 Client for Solaris 5.2.7 Cisco VPN 5000 Client for Mac OS 5.2.2 Cisco VPN 5000 Client for Mac OS 5.2.1 Cisco VPN 5000 Client for Mac OS 5.1.2 Cisco VPN 5000 Client for Linux 5.2.7 Cisco VPN 5000 Client for Linux 5.2.6 Cisco VPN 3002 Hardware Client Cisco VPN 3000 Concentrator 4.0.1 Cisco VPN 3000 Concentrator 4.0 .x Cisco VPN 3000 Concentrator 4.0 Cisco VPN 3000 Concentrator 3.6.7 D Cisco VPN 3000 Concentrator 3.6.7 Cisco VPN 3000 Concentrator 3.6.1 Cisco VPN 3000 Concentrator 3.6 Cisco VPN 3000 Concentrator 3.5.5 Cisco VPN 3000 Concentrator 3.5.4 Cisco VPN 3000 Concentrator 3.5.3 Cisco VPN 3000 Concentrator 3.5.2 Cisco VPN 3000 Concentrator 3.5.1 Cisco VPN 3000 Concentrator 3.5 (Rel) Cisco VPN 3000 Concentrator 3.1.4 Cisco VPN 3000 Concentrator 3.1.2 Cisco VPN 3000 Concentrator 3.1.1 Cisco VPN 3000 Concentrator 3.1 (Rel) Cisco VPN 3000 Concentrator 3.1 Cisco VPN 3000 Concentrator 3.0.4 Cisco VPN 3000 Concentrator 3.0.3 (B) Cisco VPN 3000 Concentrator 3.0.3 (A) Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 2.5.2 (F) Cisco VPN 3000 Concentrator 2.5.2 (D) Cisco VPN 3000 Concentrator 2.5.2 (C) Cisco VPN 3000 Concentrator 2.5.2 (B) Cisco VPN 3000 Concentrator 2.5.2 (A) Cisco VPN 3000 Concentrator 2.0 Certicom MovianVPN |
| Not Vulnerable: | |
Discussion
Multiple Vendor IKE Insecure XAUTH Implementation Vulnerabilities
IKE, when implemented with 'XAUTH' extensions, has been reported prone to sensitive information disclosure.
The vulnerability has been reported to result from a weaknesses in XAUTH when used as an extension of IKE. Specifically, the server does not have to be authorized to the client in an XAUTH based IKE negotiation.
This could potentially be exploited by an attacker to carry out a session to a legitimate server, as the client who leaked the sensitive information. Other attacks would also be possible.
Although specific vendor product versions affected by this issue are not currently known, the researcher has stated that the following vendors are or may be affected: Cisco, Nortel, SafeNet, MovianVPN, Certicom, and Funk AdmitOne. It should be noted that other vendors/products may be affected as well.
IKE, when implemented with 'XAUTH' extensions, has been reported prone to sensitive information disclosure.
The vulnerability has been reported to result from a weaknesses in XAUTH when used as an extension of IKE. Specifically, the server does not have to be authorized to the client in an XAUTH based IKE negotiation.
This could potentially be exploited by an attacker to carry out a session to a legitimate server, as the client who leaked the sensitive information. Other attacks would also be possible.
Although specific vendor product versions affected by this issue are not currently known, the researcher has stated that the following vendors are or may be affected: Cisco, Nortel, SafeNet, MovianVPN, Certicom, and Funk AdmitOne. It should be noted that other vendors/products may be affected as well.
Exploit / POC
Multiple Vendor IKE Insecure XAUTH Implementation Vulnerabilities
It is reported that an exploit exists that leverages this issue. It is not known whether this exploit is circulating in the wild or not.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
It is reported that an exploit exists that leverages this issue. It is not known whether this exploit is circulating in the wild or not.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Multiple Vendor IKE Insecure XAUTH Implementation Vulnerabilities
Solution:
Cisco has released a security notice, which outlines updates that are scheduled for release in the third quarter of 2004 to address this issue. This update will augment the Hybrid Auth model so that a group pre-shared key for VPN group identification is required. Please see the referenced notice for further details.
It has been reported that some vendors may have addressed this issue in their VPN clients and other software. This has not yet been confirmed by Symantec. Please contact the relevant vendor representative for further information regarding this issue.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Cisco has released a security notice, which outlines updates that are scheduled for release in the third quarter of 2004 to address this issue. This update will augment the Hybrid Auth model so that a group pre-shared key for VPN group identification is required. Please see the referenced notice for further details.
It has been reported that some vendors may have addressed this issue in their VPN clients and other software. This has not yet been confirmed by Symantec. Please contact the relevant vendor representative for further information regarding this issue.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Multiple Vendor IKE Insecure XAUTH Implementation Vulnerabilities
References:
References: