INFORMATION BULLETIN
INFORMATION BULLETIN
| PROBLEM: | Multiple vulnerabilities have been indentified for the Cisco VPN 3000 and 5000 series concentrators and Cisco VPN 3002 Hardware Client. The Cisco VPN concentrators are a family of purpose-built, remote access Virtual Private Network (VPN) platforms for data encryption and authentication. |
| PLATFORM: | Cisco VPN 3000 series concentrators, specifically models 3005, 3015,
3030, 3060, 3080. Cisco VPN 3002 Hardware Client. MAC OS VPN 5000 Client releases earlier than 5.2.2. Linux VPN 5000 Client releases earlier than 5.2.7. Solaris VPN 5000 Client releases earlier than 5.2.8. |
| DAMAGE: | Impact ranges from information disclosure, privilege escalation, denial of service, to unauthorized access. |
| SOLUTION: | Upgrading to the latest versions. |
| VULNERABILITY ASSESSMENT: |
The risk is MEDIUM. Cisco advises all their affected customers to obtain and install updates through their regular update channels. |
[***** Start Cisco Security Advisory *****] Cisco Security Advisory: Cisco VPN 3000 Concentrator Multiple Vulnerabilities Revision 2.0 For Public Release 2002 September 03 at 1500 UTC Last Updated 2002 September 03 10:00 PM US/Pacific -------------------------------------------------------------------------------- Contents Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice Distribution Revision History Cisco Security Procedures -------------------------------------------------------------------------------- Summary The Cisco VPN 3000 series concentrators are a family of purpose-built, remote access Virtual Private Network (VPN) platforms for data encryption and authentication. This advisory documents multiple vulnerabilities for the Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client. These vulnerabilities are documented as Cisco bug ID's CSCdt56514, CSCdu15622, CSCdu35577, CSCdu82823, CSCdv66718, CSCdv88230, CSCdw22408, CSCdw50657, CSCdx07754, CSCdx24622, CSCdx24632, CSCdx39981, CSCdx54675 and CSCdy38035. Upgrading to the latest version of code for the Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client, version 3.5.5 or 3.6.1, would protect against all of these documented vulnerabilities. This advisory will be posted at http://www.cisco.com/warp/public/707/vpn3k- multiple-vuln-pub.shtml. Affected Products The Cisco VPN 3000 series concentrators are affected by these vulnerabilities. This series includes models 3005, 3015, 3030, 3060, 3080 and the Cisco VPN 3002 Hardware Client. DDTS - Description Affected Releases CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability 3.6(Rel) 3.5(Rel) to 3.5.4 earlier than 3.1.2 earlier than 3.0.3(B) 2.x.x CSCdu15622 - HTML parser processing vulnerability earlier than 3.0.3(B) 2.x.x CSCdu35577 - Concentrator gives out too much information in application layer banners earlier than 3.5.4 3.1.x 3.0.x 2.x.x CSCdu82823 - BSD sourced telnetd vulnerability earlier than 3.0.4 2.x.x CSCdv66718 - Windows PPTP client vulnerability earlier than 2.5.2(F) CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability earlier than 3.5.1 earlier than 3.1.4 3.0.x 2.x.x CSCdw50657 - Certificate passwords visible with HTML view source vulnerability earlier than 3.5.2 3.1.x 3.0.x 2.x.x CSCdx07754 - XML public rule vulnerability earlier than 3.5.3 3.1.x 3.0.x 2.x.x CSCdx24622 - HTML pages access vulnerability earlier than 3.5.3 3.1.x 3.0.x 2.x.x CSCdx24632 - HTML login processing vulnerability earlier than 3.5.3 3.1.x 3.0.x 2.x.x CSCdx39981 - VPN client authentication vulnerability 3.6(Rel) earlier than 3.5.5 3.1.x 3.0.x 2.x.x CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability earlier than 3.5.4 3.1.x 3.0.x 2.x.x CSCdy38035 - ISAKMP packet processing vulnerability 3.6(Rel) earlier than 3.5.5 3.1.x 3.0.x 2.x.x These vulnerabilities do not affect the VPN Client software nor the Cisco VPN 5000 series concentrators. No other Cisco product is known to be affected by these vulnerabilities. To determine if a Cisco VPN 3000 series concentrator is running affected software, check the software revision via the web interface or the console menu. Details DDTS - Description Details CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability If a Cisco VPN 3000 series concentrator is set up for internal authentication with only group accounts configured and no user accounts configured, then a VPN client logging in using PPTP or IPSEC user authentication succeeds by using a group name/password as login credentials. For VPN client connections using IPSEC user authentication, the Cisco VPN series concentrator will not allow the VPN client to use the same group name/password as what is configured in the VPN client's connection properties, but if another group account exists on the concentrator, then using its group name/password the VPN client can authenticate to the VPN concentrator. The Cisco VPN 3002 Hardware Client does not support PPTP or incoming connections and therefore is not vulnerable to this problem. CSCdu15622 - HTML parser processing vulnerability Very long URL requests to the HTML interface cause the VPN 3000 series concentrator to stop responding. The CPU on the Cisco VPN concentrator jumps to 100%. The IP stack of the VPN concentrator stops responding. The VPN concentrator recovers approximately five minutes after the DoS attack is stopped. CSCdu35577 - Concentrator gives out too much information in application layer banners The Cisco VPN 3000 series concentrators give out too much information in application layer banners. The SSH banner gives out information about the device apart from the SSH version numbers. The FTP banner gives information about the device and the local time. An incorrect HTTP page request gives out information about the device, the name of the person who compiled the software and the time of compilation. CSCdu82823 - BSD sourced telnetd vulnerability Cisco VPN 3000 series concentrators run telnetd daemon code derived from the BSD source and are vulnerable to a buffer overflow in the telnet option handling, which can cause the telnet daemon to crash and result in a VPN concentrator reload. This vulnerability is also documented as CERT Advisory CA-2001-21. Telnet is not permitted on the public interface of the VPN concentrator in the default configuration and is never permitted on the public interface of the VPN 3002 Hardware Client. CSCdv66718 - Windows PPTP client vulnerability Windows native PPTP clients connecting with the No Encryption option set can cause the Cisco VPN 3000 series concentrator, with encryption set, to reload. CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability On password containing HTML pages for the Cisco VPN 3000 series concentrator it is possible for restricted access administrative users to observe the password in clear text upon viewing the source of the web page without having the appropriate level of administrative access. CSCdw50657 - Certificate passwords visible with HTML view source vulnerability On the Certificate Management HTML pages for the Cisco VPN 3000 series concentrator it is possible for administrative users to observe the unencrypted certificate password in clear text upon viewing the source of the web page. CSCdx07754 - XML public rule vulnerability. When a Cisco VPN 3000 series concentrator has the XML filter configuration enabled on its public interface, the configuration adds the rule "HTTPS on P ublic Inbound (XML-Auto)(forward/in)" to the public filter and sets the value for the protocol incorrectly to "ANY" and the value for the destination port to "443". The VPN concentrator checks the destination port field value only when the protocol is set to TCP or UDP. So enabling this filter configuration effectively allows any protocol on any port through the VPN Concentrator. CSCdx24622 - HTML pages access vulnerability Users can access a few Cisco VPN 3000 series concentrator HTML pages containing limited information without proper authentication. CSCdx24632 - HTML login processing vulnerability It is possible to cause the Cisco VPN 3000 series concentrator to reload by modifying an HTML file and posting very large strings as the username/password while accessing the HTML interface on the VPN concentrator. CSCdx39981 - VPN client authentication vulnerability When using a VPN client it is possible to cause the Cisco VPN 3000 series concentrator to reload by responding with a very large string for the username prompt. CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability The Cisco VPN 3000 series concentrator does not drop an incoming LAN-to-LAN connection even when it already has a security association for the same remote network with another device. Instead it disconnects the previously established connection and establishes a connection with the new device. The VPN concentrator also does not verify if the data coming across a LAN-to-LAN connection is being sourced from the correct network. CSCdy38035 - ISAKMP packet processing vulnerability Malformed or very large ISAKMP packets can cause device reloads in four instances: Upon receipt of a malformed ISAKMP packet Upon having debug turned on during the receipt of various malformed packets Upon receiving a very large number of payloads in an ISAKMP packet Upon having debug turned on while receiving large ISAKMP packets. These vulnerabilities are documented as Cisco bug ID's CSCdt56514, CSCdu15622, CSCdu35577, CSCdu82823, CSCdv66718, CSCdv88230, CSCdw22408, CSCdw50657, CSCdx07754, CSCdx24622, CSCdx24632, CSCdx39981, CSCdx54675 and CSCdy38035, which require a CCO account to view and can be viewed after 2002 September 4 at 1500 UTC. Impact DDTS - Description Impact CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability Unintended access to the network serviced by the VPN 3000 series concentrator. CSCdu15622 - HTML parser processing vulnerability This vulnerability can be exploited to initiate a DOS attack. CSCdu35577 - Concentrator gives out too much information in application layer banners The extra information given out could help an attacker plan his attacks. CSCdu82823 - BSD sourced telnetd vulnerability. This vulnerability can be exploited to initiate a DOS attack. CSCdv66718 - Windows PPTP client vulnerability This vulnerability can be exploited to initiate a DOS attack. CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability Unintended disclosure of passwords on non administrative user accessed HTML pages. CSCdw50657 - Certificate passwords visible with HTML view source vulnerability Unintended disclosure of passwords on an administrative user accessed HTML page. CSCdx07754 - XML public rule vulnerability Unintended access to the network serviced by the Cisco VPN 3000 series concentrator. CSCdx24622 - HTML pages access vulnerability Unintended access to generic content on a few HTML pages. CSCdx24632 - HTML login processing vulnerability This vulnerability can be exploited to initiate a DOS attack. CSCdx39981 - VPN client authentication vulnerability This vulnerability can be exploited to initiate a DOS attack. CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability This vulnerability can be exploited to initiate a DOS attack. CSCdy38035 - ISAKMP packet processing vulnerability These vulnerabilities can be exploited to initiate DOS attacks. Software Versions and Fixes DDTS - Description Fixed Releases CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability 3.6.1 or later 3.5.5 or later 3.1.2 or later for 3.1.x releases 3.0.3(B) or later for 3.0.x releases CSCdu15622 - HTML parser processing vulnerability 3.6(Rel) or later 3.5(Rel) or later 3.1(Rel) or later 3.0.3(B) or later CSCdu35577 - Concentrator gives out too much information in application layer banners 3.6(Rel) or later 3.5.4 or later CSCdu82823 - BSD sourced telnetd vulnerability 3.6(Rel) or later 3.5(Rel) or later 3.1(Rel) or later 3.0.4 or later CSCdv66718 - Windows PPTP client vulnerability 3.6(Rel) or later 3.5(Rel) or later 3.1(Rel) or later 3.0(Rel) or later 2.5.2(F) or later CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability 3.6(Rel) or later 3.5.1 or later 3.1.4 or later CSCdw50657 - Certificate passwords visible with HTML view source vulnerability 3.6(Rel) or later 3.5.2 or later CSCdx07754 - XML public rule vulnerability 3.6(Rel) or later 3.5.3 or later CSCdx24622 - HTML pages access vulnerability 3.6(Rel) or later 3.5.3 or later CSCdx24632 - HTML login processing vulnerability 3.6(Rel) or later 3.5.3 or later CSCdx39981 - VPN client authentication vulnerability 3.6.1 or later 3.5.5 or later CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability 3.6(Rel) or later 3.5.4 or later CSCdy38035 - ISAKMP packet processing vulnerability 3.6.1 or later 3.5.5 or later The procedure to upgrade to the fixed software version is detailed at www.cisco.com/univercd/cc/td/doc/product/vpn/vpn3000/vpn3kco/vcoug/usr_3_ 0/admin.htm#xtocid2259937. Obtaining Fixed Software Cisco is offering free software upgrades to address these vulnerabilities for all affected customers. Customers may only install and expect support for the feature sets they have purchased. Customers with service contracts should contact their regular update channels to obtain the free software upgrade identified via this advisory. For most customers with service contracts, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com/kobayashi/sw-center/vpn/3000/ . To access this link you must be a registered user and you must be logged in. Customers whose Cisco products are provided or maintained through a prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with obtaining the free software upgrade(s). Customers who purchased directly from Cisco but who do not hold a Cisco service contract, and customers who purchase through third party vendors but are unsuccessful at obtaining fixed software through their point of sale, should obtain fixed software by contacting the Cisco Technical Assistance Center (TAC) using the contact information listed below. In these cases, customers are entitled to obtain an upgrade to a later version of the same release or as indicated by the applicable corrected software version in the Software Versions and Fixes section (noted above). Cisco TAC contacts are as follows: +1 800 553 2447 (toll free from within North America) +1 408 526 7209 (toll call from anywhere in the world) e-mail: tac@cisco.com See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Please have your product serial number available and give the URL of this advisory as evidence of your entitlement to a free upgrade. Please do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades. Workarounds DDTS - Description Workarounds / Mitigation techniques CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability If possible use external authentication like TACACS+ or RADIUS. CSCdu15622 - HTML parser processing vulnerability Restrict access to the HTML interface such that connections are permitted only from trusted sources. CSCdu35577 - Concentrator gives out too much information in application layer banners There is no workaround. CSCdu82823 - BSD sourced telnetd vulnerability Restrict access to the telnet interface such that connections are permitted only from trusted sources. CSCdv66718 - Windows PPTP client vulnerability If possible configure the VPN 3000 series concentrator for IPSEC support only. CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability Restrict access to the HTML interface such that connections are permitted only from trusted sources. CSCdw50657 - Certificate passwords visible with HTML view source vulnerability Restrict access to the HTML interface such that connections are permitted only from trusted sources. CSCdx07754 - XML public rule vulnerability Remove any XML filter on the public interface. CSCdx24622 - HTML pages access vulnerability Restrict access to the HTML interface such that connections are permitted only from trusted sources. CSCdx24632 - HTML login processing vulnerability Restrict access to the HTML interface such that connections are permitted only from trusted sources. CSCdx39981 - VPN client authentication vulnerability There is no workaround. CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability There is no workaround. CSCdy38035 - ISAKMP packet processing vulnerability There is no workaround. The Cisco PSIRT recommends that affected users upgrade to a fixed software version of code. Exploitation and Public Announcements The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. These vulnerabilities were reported to PSIRT by internal development testing and customers. The invalid ISAKMP packet length vulnerability addressed by CSCdy38035 was reported to the PSIRT by Phenoelit. The vulnerabilities addressed by CSCdx24622 and CSCdx24632 were reported to Cisco by Vigilante. Status of This Notice: FINAL This is a final advisory. Although Cisco cannot guarantee the accuracy of all statements in this advisory, all of the facts have been checked to the best of our ability. Cisco does not anticipate issuing updated versions of this advisory unless there is some material change in the facts. Should there be a significant change in the facts, Cisco may update this advisory. A stand-alone copy or paraphrase of the text of this security advisory that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution This advisory will be posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml. In addition to worldwide website posting, a text version of this advisory is clear-signed with the Cisco PSIRT PGP key having the fingerprint FEB1 1B89 A64B 60BB 4770 D1CE 93D2 FF06 F236 759C and is posted to the following e-mail and Usenet news recipients: cust-security-announce@cisco.com bugtraq@securityfocus.com disclosure@lists.netsys.com first-teams@first.org (includes CERT/CC) firewalls@lists.gnac.com cisco-nsp@puck.nether.net cisco@spot.colorado.edu comp.dcom.sys.cisco Various internal Cisco mailing lists Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History Revision 2.0 2002-September-03 Revised public release Revision 1.0 2002-September-03 Initial public release Cisco Security Procedures Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/go/psirt. This includes instructions for press inquiries regarding Cisco security advisories. -------------------------------------------------------------------------------- This advisory is copyright 2002 by Cisco Systems, Inc. This advisory may be redistributed freely after the release date given at the top of the text, provided that redistributed copies are complete and unmodified, including all date and version information. [***** End Cisco Security Advisory *****] [***** Start Cisco Security Advisory: VPN Client Multiple Vulnerabilities- Second Set *****] Summary Multiple vulnerabilities exist in the Cisco Virtual Private Network (VPN) Client software. These vulnerabilities are documented as Cisco Bug IDs CSCdt35749, CSCdt60391, CSCdw87717, CSCdx89416 and CSCdy37058. There are no workarounds available to mitigate the effects of these vulnerabilities. This advisory will be posted at http://www.cisco.com/warp/public/707/vpnclient-multiple2-vuln-pub.shtml. Affected Products The VPN Client software program runs on the following platforms. Microsoft Windows based PC. Red Hat Version 6.2 Linux (Intel), or compatible distribution, using kernel Version 2.2.12 or later. It does not support kernel Version 2.5. Solaris UltraSPARC running a 32-bit or a 64-bit kernel OS Version 2.6 or later. Mac OS X Version 10.1.0 or later. DDTS Description Affected Releases CSCdt35749 - NETBIOS TCP packet earlier than 3.0.5 vulnerability 2.x.x ---------------------------------------------------------------- CSCdt60391 - Group passwords visible earlier than 3.5.1C usingutility program 3.1.x 3.0.x 2.x.x ---------------------------------------------------------------- CSCdw87717 - Concentrator certificate earlier than 3.5.1C identity vulnerability 3.1.x 3.0.x 2.x.x ---------------------------------------------------------------- CSCdx89416 - Random number generation earlier than 3.5.2B improvement 3.1.x 3.0.x 2.x.x --------------------------------------------------------------- CSCdy37058 - TCP filter vulnerability 3.6(Rel) earlier than 3.5.4 3.1.x 3.0.x 2.x.x --------------------------------------------------------------- No other Cisco products are currently known to be affected by these vulnerabilities. Details The VPN Client software program on a remote workstation, communicating with a Cisco VPN device on an enterprise network or with a service provider, creates a secure connection over the Internet. Through this connection you can access a private network as if you were an onsite user. DDTS Description Details CSCdt35749 - NETBIOS TCP The VPN Client is vulnerable to packet vulnerability NETBIOS TCP packets that have their source and destination ports set to 137 (NETBIOS Name Service). Upon receiving such a packet, the VPN Client crashes. ------------------------------------------------------------------------ CSCdt60391 - Group passwords There is a utility program under visible using utility program Windows that can decipher the group password field, which is shown as a series of asterisks (***...) on the authentication property page of the VPN Client. ------------------------------------------------------------------------ CSCdw87717 - Concentrator When a VPN Client connects to a certificate identity VPN Concentrator using certificates, vulnerability the VPN Client does not have the ability to verify that specific certificate DN fields match in the certificate received from the VPN Concentrator. ------------------------------------------------------------------------ CSCdx89416 - Random number The random number generation process generation improvement in the VPN Client software has been significantly improved to increase the randomness of the generated numbers. ------------------------------------------------------------------------ CSCdy37058 - TCP filter It is possible to get the VPN Client, vulnerability which is configured for all tunnel mode (split tunneling disabled mode), to acknowledge a TCP packet via the tunnel-assigned IP, when the packet is sent to it from outside the tunnel. The 3.5.x releases are protected against this vulnerability if the firewall is configured to be in "always on" mode. The 3.6(Rel) release is vulnerable even when the firewall is in "always on" mode. These vulnerabilities are documented in the Cisco Bug Toolkit as Bug IDs CSCdt35749, CSCdt60391, CSCdw87717, CSCdx89416 and CSCdy37058, and can be viewed after 2002 September 6 at 1500 UTC. To access this tool, you must be a registered user and you must be logged in. Impact DDTS Description Impact CSCdt35749 - NETBIOS TCP This vulnerability can be exploited to packet vulnerability initiate a denial-of-service attack. ------------------------------------------------------------------------ CSCdt60391 - Group Unintended disclosure of the group passwords visible using utility password. program ------------------------------------------------------------------------ CSCdw87717 - Concentrator This vulnerability could be exploited to certificate identity initiate a man-in-the-middle attack. vulnerability ----------------------------------------------------------------------- CSCdx89416 - Random number Improvement in the randomness of generation improvement random numbers generated for use by the VPN Client. ----------------------------------------------------------------------- CSCdy37058 - TCP filter This vulnerability could be exploited to vulnerability leak information about the VPN Client workstation. Software Versions and Fixes DDTS Description Fixed Releases CSCdt35749 - NETBIOS TCP packet 3.6(Rel) or later vulnerability 3.5(Rel) or later 3.1(Rel) or later 3.0.5 or later ------------------------------------------------------------------ CSCdt60391 - Group passwords visible using 3.6(Rel) or later utility program 3.5.1C or later ------------------------------------------------------------------ CSCdw87717 - Concentrator certificate 3.6(Rel) or later identity vulnerability 3.5.1C or later ------------------------------------------------------------------ CSCdx89416 - Random number generation 3.6(Rel) or later improvement 3.5.2B or later ------------------------------------------------------------------ CSCdy37058 - TCP filter vulnerability 3.6.1 or later 3.5.4 or later The procedure to upgrade on the various platforms to the fixed software version is detailed in the documentation available at http://www.cisco.com/univercd/cc/td/doc/product/vpn/client/. Obtaining Fixed Software Cisco is offering free software upgrades to address these vulnerabilities for all affected customers. Customers may only install and expect support for the feature sets they have purchased. Customers with service contracts should contact their regular update channels to obtain the free software upgrade identified via this advisory. For most customers with service contracts, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com/kobayashi/sw-center/vpn/client/. To access the software download URL, you must be a registered user and you must be logged in. Customers whose Cisco products are provided or maintained through a prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with obtaining the free software upgrade(s). Customers who purchased directly from Cisco but who do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale, should obtain fixed software by contacting the Cisco Technical Assistance Center (TAC) using the contact information listed below. In these cases, customers are entitled to obtain an upgrade to a later version of the same release or as indicated by the applicable corrected software version in Software Versions and Fixes. Cisco TAC contacts are as follows: +1 800 553 2447 (toll free from within North America) +1 408 526 7209 (toll call from anywhere in the world) e-mail: tac@cisco.com See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Please have your product serial number available and give the URL of this advisory as evidence of your entitlement to a free upgrade. Please do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades. Workarounds DDTS Description Workaround CSCdt35749 - NETBIOS TCP packet There is no workaround. vulnerability ------------------------------------------------------------------ CSCdt60391 - Group passwords visible There is no workaround. using utility program ------------------------------------------------------------------ CSCdw87717 - Concentrator certificate There is no workaround. identity vulnerability ------------------------------------------------------------------ CSCdx89416 - Random number Not applicable. generation improvement ------------------------------------------------------------------ CSCdy37058 - TCP filter vulnerability There is no workaround. The Cisco PSIRT recommends that affected users upgrade to a fixed software version of code. Exploitation and Public Announcements The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory. These vulnerabilities were reported to PSIRT by internal development testing and customers. Status of This Notice: FINAL This is a final notice. Although Cisco cannot guarantee the accuracy of all statements in this advisory, all of the facts have been checked to the best of our ability. Cisco does not anticipate issuing updated versions of this advisory unless there is some material change in the facts. Should there be a significant change in the facts, Cisco may update this advisory. A stand-alone copy or paraphrase of the text of this security advisory that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution This notice will be posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/vpnclient-multiple2-vuln-pub.shtml. In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients: cust-security-announce@cisco.com bugtraq@securityfocus.com disclosure@lists.netsys.com first-teams@first.org (includes CERT/CC) firewalls@lists.gnac.com cisco-nsp@puck.nether.net cisco@spot.colorado.edu comp.dcom.sys.cisco Various internal Cisco mailing lists Future updates of this notice, if any, will be placed on Cisco's worldwide web server, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the URL given above for any updates. Revision History Revision 1.0 2002-September-05 Initial public release. Cisco Security Procedures Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/go/psirt. This includes instructions for press inquiries regarding Cisco security advisories. This notice is Copyright 2002 by Cisco Systems, Inc. This notice may be redistributed freely after the release date given at the top of the text, provided that redistributed copies are complete and unmodified, and include all date and version information. [***** End Cisco Security Advisory: VPN Client Multiple Vulnerabilities - Second Set *****] [Appended on September 23 with Cisco VPN 5000 Client information ] Cisco Security Advisory: Cisco VPN 5000 Client Multiple Vulnerabilities Revision 1.0 For Public Release 2002 September 18 08:00 (UTC -0800) Summary Multiple vulnerabilities exist in the Cisco Virtual Private Network (VPN) 5000 Client software. These vulnerabilities are documented as Cisco bug ID CSCdx17109 and CSCdy20065. There are some workarounds available to mitigate the effects of these vulnerabilities. This advisory will be posted at http://www.cisco.com/warp/public/707/vpn5k-client-multiple-vuln-pub.shtml. Affected Products DDTS - Description Affected Releases CSCdx17109 - MAC OS VPN 5000 Client password vulnerability MAC OS VPN 5000 Client releases earlier than 5.2.2 CSCdy20065 - Linux and Solaris VPN 5000 Client buffer overflow vulnerability Linux VPN 5000 Client releases earlier than 5.2.7 Solaris VPN 5000 Client releases earlier than 5.2.8 The Cisco VPN 3000 client and the Cisco VPN client are not affected. No other Cisco products are currently known to be affected by these vulnerabilities. Details The VPN Client software program on a remote workstation, communicating with a Cisco VPN device on an enterprise network or with a service provider, creates a secure connection over the Internet. Through this connection you can access a private network as if you were an onsite user. DDTS - Description Details CSCdx17109 - MAC OS VPN 5000 Client password vulnerability When saving the "Default Connection" in the resource fork of the preferences file, the client saves the entire contents of the data structure that represents the "Default Connection" which includes the most recently used login password. This password can be read in plain text using the ResEdit tool. This occurs regardless of whether "SaveSecrets" is enabled or disabled, and regardless of whether you encrypt passwords or not. CSCdy20065 - Linux and Solaris VPN 5000 Client buffer overflow vulnerability Two buffer overflow issues exist in the VPN 5000 Client for Linux and Solaris. One in the close_tunnel binary and one in the open_tunnel binary. To exploit the vulnerability one has to be logged in on the workstation. The buffer overflows could be locally exploited to gain root privileges on the workstation. These vulnerabilities are documented in the Cisco Bug Toolkit as Bug IDs CSCdx17109 and CSCdy20065, and can be viewed after September 19, 2002 at 1500 UTC. To access this tool, you must be a registered user and you must be logged in. Impact DDTS - Description Impact CSCdx17109 - MAC OS VPN 5000 Client password vulnerability Unintended exposure of password CSCdy20065 - Linux and Solaris VPN 5000 Client buffer overflow vulnerability This vulnerability could be locally exploited to elevate one's system privileges. Software Versions and Fixes DDTS - Description Fixed Releases CSCdx17109 - MAC OS VPN 5000 Client password vulnerability MAC OS VPN 5000 Client release 5.2.2 or later CSCdy20065 - Linux and Solaris VPN 5000 Client buffer overflow vulnerability Linux VPN 5000 Client release 5.2.7 or later Solaris VPN 5000 Client release 5.2.8 or later The procedure to upgrade to the fixed software version is detailed at http://www.cisco.com/univercd/cc/td/doc/product/aggr/vpn5000/client/. Obtaining Fixed Software Cisco is offering free software upgrades to address these vulnerabilities for all affected customers. Customers may only install and expect support for the feature sets they have purchased. Customers with service contracts should contact their regular update channels to obtain the free software upgrade identified via this advisory. For most customers with service contracts, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com/kobayashi/sw-center/vpn/5000/ . To access the software download URL http://www.cisco.com/kobayashi/sw-center/vpn/5000/ , you must be a registered user and you must be logged in. Customers whose Cisco products are provided or maintained through a prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with obtaining the free software upgrade(s). Customers who purchased directly from Cisco but who do not hold a Cisco service contract, and customers who purchase through third party vendors but are unsuccessful at obtaining fixed software through their point of sale, should obtain fixed software by contacting the Cisco Technical Assistance Center (TAC) using the contact information listed below. In these cases, customers are entitled to obtain an upgrade to a later version of the same release or as indicated by the applicable corrected software version in the Software Versions and Fixes section (noted above). Cisco TAC contacts are as follows: +1 800 553 2447 (toll free from within North America) +1 408 526 7209 (toll call from anywhere in the world) e-mail: tac@cisco.com See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Please have your product serial number available and give the URL of this advisory as evidence of your entitlement to a free upgrade. Please do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades. Workarounds DDTS - Description Workaround / Mitigation Techniques CSCdx17109 - MAC OS VPN 5000 Client password vulnerability An attempt to log in using a wrong password after one has finished using the connection causes the wrong password to be stored in the resources fork. Turn the "Save Secrets" option off on the concentrator. This will stop the VPN 5000 Client from saving the password. CSCdy20065 - Linux and Solaris VPN 5000 Client buffer overflow vulnerability There is no workaround. The Cisco PSIRT recommends that affected users upgrade to a fixed software version of code. Exploitation and Public Announcements The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory. Cisco Bug ID CSCdx17109 was reported to Cisco by a customer. Cisco Bug ID CSCdy20065 was reported to Cisco by Niels Heinen of Ubizen. Status of This Advisory: FINAL This is a final advisory. Although Cisco cannot guarantee the accuracy of all statements in this advisory, all of the facts have been checked to the best of our ability. Cisco does not anticipate issuing updated versions of this advisory unless there is some material change in the facts. Should there be a significant change in the facts, Cisco may update this advisory. A stand-alone copy or paraphrase of the text of this security advisory that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution This advisory will be posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/vpn5k-client-multiple-vuln-pub.shtml. In addition to worldwide website posting, a text version of this advisory is clear-signed with the Cisco PSIRT PGP key having the fingerprint FEB1 1B89 A64B 60BB 4770 D1CE 93D2 FF06 F236 759C and is posted to the following e-mail and Usenet news recipients: cust-security-announce@cisco.com bugtraq@securityfocus.com full-disclosure@lists.netsys.com first-teams@first.org (includes CERT/CC) firewalls@lists.gnac.com cisco-nsp@puck.nether.net cisco@spot.colorado.edu comp.dcom.sys.cisco Various internal Cisco mailing lists Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History Revision 1.0 September 18, 2002 Initial public release Cisco Security Procedures Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/warp/public/707/sec_incident_response.shtml. This includes instructions for press inquiries regarding Cisco security notices. All Cisco Security Advisories are available at http://www.cisco.com/go/psirt. -------------------------------------------------------------------------------- This advisory is copyright 2002 by Cisco Systems, Inc. This advisory may be redistributed freely after the release date given at the top of the text, provided that redistributed copies are complete and unmodified, including all date and version information. [ End Cisco VPN 5000 Client information ]
Voice: +1 925-422-8193 (7 x 24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org
World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org