navbar
Strip_SecurityAdvisories

Cisco Security Advisory: Cisco VPN 3000 Concentrator Multiple Vulnerabilities

Document ID: 26760

Advisory ID: cisco-sa-20020903-vpn3k-vulnerability

http://www.cisco.com/warp/public/707/cisco-sa-20020903-vpn3k-vulnerability.shtml

Revision 2.0

Last Updated 2002 September 04 0500 UTC (GMT)

For Public Release 2002 September 03 1500 UTC (GMT)

Please provide your feedback on this document.

Contents

Summary
Affected Products
Details
Impact
Software Versions and Fixes
Workarounds
Obtaining Fixed Software
Exploitation and Public Announcements
Status of This Notice: FINAL
Distribution
Revision History
Cisco Security Procedures

Summary

The Cisco VPN 3000 series concentrators are a family of purpose-built, remote access Virtual Private Network (VPN) platforms for data encryption and authentication.

This advisory documents multiple vulnerabilities for the Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client. These vulnerabilities are documented as Cisco bug ID's CSCdt56514, CSCdu15622, CSCdu35577, CSCdu82823, CSCdv66718, CSCdv88230, CSCdw22408, CSCdw50657, CSCdx07754, CSCdx24622, CSCdx24632, CSCdx39981, CSCdx54675 and CSCdy38035. Upgrading to the latest version of code for the Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client, version 3.5.5 or 3.6.1, would protect against all of these documented vulnerabilities.

This advisory will be posted at http://www.cisco.com/warp/public/707/cisco-sa-20020903-vpn3k-vulnerability.shtml.

Affected Products

This section provides details on affected products.

Vulnerable Products

The Cisco VPN 3000 series concentrators are affected by these vulnerabilities. This series includes models 3005, 3015, 3030, 3060, 3080 and the Cisco VPN 3002 Hardware Client.

DDTS - Description

Affected Releases

CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability
  • 3.6(Rel)
  • 3.5(Rel) to 3.5.4
  • earlier than 3.1.2
  • earlier than 3.0.3(B)
  • 2.x.x

CSCdu15622 - HTML parser processing vulnerability
  • earlier than 3.0.3(B)
  • 2.x.x

CSCdu35577 - Concentrator gives out too much information in application layer banners
  • earlier than 3.5.4
  • 3.1.x
  • 3.0.x
  • 2.x.x

CSCdu82823 - BSD sourced telnetd vulnerability
  • earlier than 3.0.4
  • 2.x.x

CSCdv66718 - Windows PPTP client vulnerability
  • earlier than 2.5.2(F)

CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability
  • earlier than 3.5.1
  • earlier than 3.1.4
  • 3.0.x
  • 2.x.x

CSCdw50657 - Certificate passwords visible with HTML view source vulnerability
  • earlier than 3.5.2
  • 3.1.x
  • 3.0.x
  • 2.x.x

CSCdx07754 - XML public rule vulnerability
  • earlier than 3.5.3
  • 3.1.x
  • 3.0.x
  • 2.x.x

CSCdx24622 - HTML pages access vulnerability
  • earlier than 3.5.3
  • 3.1.x
  • 3.0.x
  • 2.x.x

CSCdx24632 - HTML login processing vulnerability
  • earlier than 3.5.3
  • 3.1.x
  • 3.0.x
  • 2.x.x

CSCdx39981 - VPN client authentication vulnerability
  • 3.6(Rel)
  • earlier than 3.5.5
  • 3.1.x
  • 3.0.x
  • 2.x.x

CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability
  • earlier than 3.5.4
  • 3.1.x
  • 3.0.x
  • 2.x.x

CSCdy38035 - ISAKMP packet processing vulnerability
  • 3.6(Rel)
  • earlier than 3.5.5
  • 3.1.x
  • 3.0.x
  • 2.x.x

To determine if a Cisco VPN 3000 series concentrator is running affected software, check the software revision via the web interface or the console menu.

Products Confirmed Not Vulnerable

These vulnerabilities do not affect the VPN Client software nor the Cisco VPN 5000 series concentrators. No other Cisco product is known to be affected by these vulnerabilities.

Details

This section provides details about the vulnerabilities described in this document.

DDTS - Description

Details

CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability

If a Cisco VPN 3000 series concentrator is set up for internal authentication with only group accounts configured and no user accounts configured, then a VPN client logging in using PPTP or IPSEC user authentication succeeds by using a group name/password as login credentials. For VPN client connections using IPSEC user authentication, the Cisco VPN series concentrator will not allow the VPN client to use the same group name/password as what is configured in the VPN client's connection properties, but if another group account exists on the concentrator, then using its group name/password the VPN client can authenticate to the VPN concentrator. The Cisco VPN 3002 Hardware Client does not support PPTP or incoming connections and therefore is not vulnerable to this problem.

CSCdu15622 - HTML parser processing vulnerability

Very long URL requests to the HTML interface cause the VPN 3000 series concentrator to stop responding. The CPU on the Cisco VPN concentrator jumps to 100%. The IP stack of the VPN concentrator stops responding. The VPN concentrator recovers approximately five minutes after the DoS attack is stopped.

CSCdu35577 - Concentrator gives out too much information in application layer banners

The Cisco VPN 3000 series concentrators give out too much information in application layer banners. The SSH banner gives out information about the device apart from the SSH version numbers. The FTP banner gives information about the device and the local time. An incorrect HTTP page request gives out information about the device, the name of the person who compiled the software and the time of compilation.

CSCdu82823 - BSD sourced telnetd vulnerability

Cisco VPN 3000 series concentrators run telnetd daemon code derived from the BSD source and are vulnerable to a buffer overflow in the telnet option handling, which can cause the telnet daemon to crash and result in a VPN concentrator reload. This vulnerability is also documented as CERT Advisory CA-2001-21. Telnet is not permitted on the public interface of the VPN concentrator in the default configuration and is never permitted on the public interface of the VPN 3002 Hardware Client.

CSCdv66718 - Windows PPTP client vulnerability

Windows native PPTP clients connecting with the No Encryption option set can cause the Cisco VPN 3000 series concentrator, with encryption set, to reload.

CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability

On password containing HTML pages for the Cisco VPN 3000 series concentrator it is possible for restricted access administrative users to observe the password in clear text upon viewing the source of the web page without having the appropriate level of administrative access.

CSCdw50657 - Certificate passwords visible with HTML view source vulnerability

On the Certificate Management HTML pages for the Cisco VPN 3000 series concentrator it is possible for administrative users to observe the unencrypted certificate password in clear text upon viewing the source of the web page.

CSCdx07754 - XML public rule vulnerability

When a Cisco VPN 3000 series concentrator has the XML filter configuration enabled on its public interface, the configuration adds the rule "HTTPS on Public Inbound (XML-Auto)(forward/in)" to the public filter and sets the value for the protocol incorrectly to "ANY" and the value for the destination port to "443". The VPN concentrator checks the destination port field value only when the protocol is set to TCP or UDP. So enabling this filter configuration effectively allows any protocol on any port through the VPN Concentrator.

CSCdx24622 - HTML pages access vulnerability

Users can access a few Cisco VPN 3000 series concentrator HTML pages containing limited information without proper authentication.

CSCdx24632 - HTML login processing vulnerability

It is possible to cause the Cisco VPN 3000 series concentrator to reload by modifying an HTML file and posting very large strings as the username/password while accessing the HTML interface on the VPN concentrator.

CSCdx39981 - VPN client authentication vulnerability

When using a VPN client it is possible to cause the Cisco VPN 3000 series concentrator to reload by responding with a very large string for the username prompt.

CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability

The Cisco VPN 3000 series concentrator does not drop an incoming LAN-to-LAN connection even when it already has a security association for the same remote network with another device. Instead it disconnects the previously established connection and establishes a connection with the new device. The VPN concentrator also does not verify if the data coming across a LAN-to-LAN connection is being sourced from the correct network.

CSCdy38035 - ISAKMP packet processing vulnerability

Malformed or very large ISAKMP packets can cause device reloads in four instances:

  • Upon receipt of a malformed ISAKMP packet
  • Upon having debug turned on during the receipt of various malformed packets
  • Upon receiving a very large number of payloads in an ISAKMP packet
  • Upon having debug turned on while receiving large ISAKMP packets.

These vulnerabilities are documented as Cisco bug ID's CSCdt56514, CSCdu15622, CSCdu35577, CSCdu82823, CSCdv66718, CSCdv88230, CSCdw22408, CSCdw50657, CSCdx07754, CSCdx24622, CSCdx24632, CSCdx39981, CSCdx54675 and CSCdy38035, which require a CCO account to view and can be viewed after 2002 September 4 at 1500 UTC.

Impact

Successful exploitation of the vulnerability may result in the issues described in this table.

DDTS - Description

Impact

CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability

Unintended access to the network serviced by the VPN 3000 series concentrator.

CSCdu15622 - HTML parser processing vulnerability

This vulnerability can be exploited to initiate a DOS attack.

CSCdu35577 - Concentrator gives out too much information in application layer banners

The extra information given out could help an attacker plan his attacks.

CSCdu82823 - BSD sourced telnetd vulnerability

This vulnerability can be exploited to initiate a DOS attack.

CSCdv66718 - Windows PPTP client vulnerability

This vulnerability can be exploited to initiate a DOS attack.

CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability

Unintended disclosure of passwords on non administrative user accessed HTML pages.

CSCdw50657 - Certificate passwords visible with HTML view source vulnerability

Unintended disclosure of passwords on non administrative user accessed HTML pages.

CSCdx07754 - XML public rule vulnerability

Unintended access to the network serviced by the Cisco VPN 3000 series concentrator.

CSCdx24622 - HTML pages access vulnerability

Unintended access to generic content on a few HTML pages.

CSCdx24632 - HTML login processing vulnerability

This vulnerability can be exploited to initiate a DOS attack.

CSCdx39981 - VPN client authentication vulnerability

This vulnerability can be exploited to initiate a DOS attack.

CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability

This vulnerability can be exploited to initiate a DOS attack.

CSCdy38035 - ISAKMP packet processing vulnerability

These vulnerabilities can be exploited to initiate DOS attacks.

Software Versions and Fixes

When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.

In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance.

DDTS - Description

Fixed Releases

CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability
  • 3.6.1 or later
  • 3.5.5 or later
  • 3.1.2 or later for 3.1.x releases
  • 3.0.3(B) or later for 3.0.x releases

CSCdu15622 - HTML parser processing vulnerability
  • 3.6(Rel) or later
  • 3.5(Rel) or later
  • 3.1(Rel) or later
  • 3.0.3(B) or later

CSCdu35577 - Concentrator gives out too much information in application layer banners
  • 3.6(Rel) or later
  • 3.5.4 or later

CSCdu82823 - BSD sourced telnetd vulnerability
  • 3.6(Rel) or later
  • 3.5(Rel) or later
  • 3.1(Rel) or later
  • 3.0.4 or later

CSCdv66718 - Windows PPTP client vulnerability
  • 3.6(Rel) or later
  • 3.5(Rel) or later
  • 3.1(Rel) or later
  • 3.0(Rel) or later
  • 2.5.2(F) or later

CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability
  • 3.6(Rel) or later
  • 3.5.1 or later
  • 3.1.4 or later

CSCdw50657 - Certificate passwords visible with HTML view source vulnerability
  • 3.6(Rel) or later
  • 3.5.2 or later

CSCdx07754 - XML public rule vulnerability
  • 3.6(Rel) or later
  • 3.5.3 or later

CSCdx24622 - HTML pages access vulnerability
  • 3.6(Rel) or later
  • 3.5.3 or later

CSCdx24632 - HTML login processing vulnerability
  • 3.6(Rel) or later
  • 3.5.3 or later

CSCdx39981 - VPN client authentication vulnerability
  • 3.6.1 or later
  • 3.5.5 or later

CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability
  • 3.6(Rel) or later
  • 3.5.4 or later

CSCdy38035 - ISAKMP packet processing vulnerability
  • 3.6.1 or later
  • 3.5.5 or later

The procedure to upgrade to the fixed software version is detailed at http://www.cisco.com/univercd/cc/td/doc/product/vpn/vpn3000/vpn3kco/vcoug/usr_3_0/admin.htm#xtocid2259937.

Workarounds

Workarounds are described in this table.

DDTS - Description

Workarounds / Mitigation techniques

CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability

If possible use external authentication like TACACS+ or RADIUS.

CSCdu15622 - HTML parser processing vulnerability

Restrict access to the HTML interface such that connections are permitted only from trusted sources.

CSCdu35577 - Concentrator gives out too much information in application layer banners

There is no workaround.

CSCdu82823 - BSD sourced telnetd vulnerability

Restrict access to the telnet interface such that connections are permitted only from trusted sources.

CSCdv66718 - Windows PPTP client vulnerability

If possible configure the VPN 3000 series concentrator for IPSEC support only.

CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability

Restrict access to the HTML interface such that connections are permitted only from trusted sources.

CSCdw50657 - Certificate passwords visible with HTML view source vulnerability

Restrict access to the HTML interface such that connections are permitted only from trusted sources.

CSCdx07754 - XML public rule vulnerability

Remove any XML filter on the public interface.

CSCdx24622 - HTML pages access vulnerability

Restrict access to the HTML interface such that connections are permitted only from trusted sources.

CSCdx24632 - HTML login processing vulnerability

Restrict access to the HTML interface such that connections are permitted only from trusted sources.

CSCdx39981 - VPN client authentication vulnerability

There is no workaround.

CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability

There is no workaround.

CSCdy38035 - ISAKMP packet processing vulnerability

There is no workaround.

The Cisco PSIRT recommends that affected users upgrade to a fixed software version of code.

Obtaining Fixed Software

Cisco has made free software available to address this vulnerability for affected customers. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment.

Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml.

Do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades.

Customers with Service Contracts

Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com.

Customers using Third-party Support Organizations

Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory.

The effectiveness of any workaround or fix is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed.

Customers without Service Contracts

Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows.

Have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC.

Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages.

Exploitation and Public Announcements

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

These vulnerabilities were reported to PSIRT by internal development testing and customers. The invalid ISAKMP packet length vulnerability addressed by CSCdy38035 was reported to the PSIRT by Phenoelit. The vulnerabilities addressed by CSCdx24622 and CSCdx24632 were reported to Cisco by Vigilante.

Status of This Notice: FINAL

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.

Distribution

This advisory will be posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20020903-vpn3k-vulnerability.shtml.

In addition to worldwide website posting, a text version of this advisory is clear-signed with the Cisco PSIRT PGP key having the fingerprint FEB1 1B89 A64B 60BB 4770 D1CE 93D2 FF06 F236 759C and is posted to the following e-mail and Usenet news recipients:

Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates.

Revision History

Revision 2.0

2002-September-03

Revised public release

Revision 1.0

2002-September-03

Initial public release

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/go/psirt. This includes instructions for press inquiries regarding Cisco security advisories.

Toolbar

All contents are Copyright © 2006-2007 Cisco Systems, Inc. All rights reserved. Important Notices and Privacy Statement.

Updated: Sep 03, 2002Document ID: 26760