-
The Cisco VPN 3000 series concentrators are a family of purpose-built, remote access Virtual Private Network (VPN) platforms for data encryption and authentication.
This advisory documents multiple vulnerabilities for the Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client. These vulnerabilities are documented as Cisco bug ID's CSCdt56514, CSCdu15622, CSCdu35577, CSCdu82823, CSCdv66718, CSCdv88230, CSCdw22408, CSCdw50657, CSCdx07754, CSCdx24622, CSCdx24632, CSCdx39981, CSCdx54675 and CSCdy38035. Upgrading to the latest version of code for the Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client, version 3.5.5 or 3.6.1, would protect against all of these documented vulnerabilities.
This advisory will be posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20020903-vpn3k-vulnerability.
-
This section provides details on affected products.
Vulnerable Products
The Cisco VPN 3000 series concentrators are affected by these vulnerabilities. This series includes models 3005, 3015, 3030, 3060, 3080 and the Cisco VPN 3002 Hardware Client.
DDTS - Description
Affected Releases
CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability
-
3.6(Rel)
-
3.5(Rel) to 3.5.4
-
earlier than 3.1.2
-
earlier than 3.0.3(B)
-
2.x.x
CSCdu15622 - HTML parser processing vulnerability
-
earlier than 3.0.3(B)
-
2.x.x
CSCdu35577 - Concentrator gives out too much information in application layer banners
-
earlier than 3.5.4
-
3.1.x
-
3.0.x
-
2.x.x
CSCdu82823 - BSD sourced telnetd vulnerability
-
earlier than 3.0.4
-
2.x.x
CSCdv66718 - Windows PPTP client vulnerability
-
earlier than 2.5.2(F)
CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability
-
earlier than 3.5.1
-
earlier than 3.1.4
-
3.0.x
-
2.x.x
CSCdw50657 - Certificate passwords visible with HTML view source vulnerability
-
earlier than 3.5.2
-
3.1.x
-
3.0.x
-
2.x.x
CSCdx07754 - XML public rule vulnerability
-
earlier than 3.5.3
-
3.1.x
-
3.0.x
-
2.x.x
CSCdx24622 - HTML pages access vulnerability
-
earlier than 3.5.3
-
3.1.x
-
3.0.x
-
2.x.x
CSCdx24632 - HTML login processing vulnerability
-
earlier than 3.5.3
-
3.1.x
-
3.0.x
-
2.x.x
CSCdx39981 - VPN client authentication vulnerability
-
3.6(Rel)
-
earlier than 3.5.5
-
3.1.x
-
3.0.x
-
2.x.x
CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability
-
earlier than 3.5.4
-
3.1.x
-
3.0.x
-
2.x.x
CSCdy38035 - ISAKMP packet processing vulnerability
-
3.6(Rel)
-
earlier than 3.5.5
-
3.1.x
-
3.0.x
-
2.x.x
To determine if a Cisco VPN 3000 series concentrator is running affected software, check the software revision via the web interface or the console menu.
Products Confirmed Not Vulnerable
These vulnerabilities do not affect the VPN Client software nor the Cisco VPN 5000 series concentrators. No other Cisco product is known to be affected by these vulnerabilities.
-
3.6(Rel)
-
This section provides details about the vulnerabilities described in this document.
DDTS - Description
Details
CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability
If a Cisco VPN 3000 series concentrator is set up for internal authentication with only group accounts configured and no user accounts configured, then a VPN client logging in using PPTP or IPSEC user authentication succeeds by using a group name/password as login credentials. For VPN client connections using IPSEC user authentication, the Cisco VPN series concentrator will not allow the VPN client to use the same group name/password as what is configured in the VPN client's connection properties, but if another group account exists on the concentrator, then using its group name/password the VPN client can authenticate to the VPN concentrator. The Cisco VPN 3002 Hardware Client does not support PPTP or incoming connections and therefore is not vulnerable to this problem.
CSCdu15622 - HTML parser processing vulnerability
Very long URL requests to the HTML interface cause the VPN 3000 series concentrator to stop responding. The CPU on the Cisco VPN concentrator jumps to 100%. The IP stack of the VPN concentrator stops responding. The VPN concentrator recovers approximately five minutes after the DoS attack is stopped.
CSCdu35577 - Concentrator gives out too much information in application layer banners
The Cisco VPN 3000 series concentrators give out too much information in application layer banners. The SSH banner gives out information about the device apart from the SSH version numbers. The FTP banner gives information about the device and the local time. An incorrect HTTP page request gives out information about the device, the name of the person who compiled the software and the time of compilation.
CSCdu82823 - BSD sourced telnetd vulnerability
Cisco VPN 3000 series concentrators run telnetd daemon code derived from the BSD source and are vulnerable to a buffer overflow in the telnet option handling, which can cause the telnet daemon to crash and result in a VPN concentrator reload. This vulnerability is also documented as CERT Advisory CA-2001-21. Telnet is not permitted on the public interface of the VPN concentrator in the default configuration and is never permitted on the public interface of the VPN 3002 Hardware Client.
CSCdv66718 - Windows PPTP client vulnerability
Windows native PPTP clients connecting with the No Encryption option set can cause the Cisco VPN 3000 series concentrator, with encryption set, to reload.
CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability
On password containing HTML pages for the Cisco VPN 3000 series concentrator it is possible for restricted access administrative users to observe the password in clear text upon viewing the source of the web page without having the appropriate level of administrative access.
CSCdw50657 - Certificate passwords visible with HTML view source vulnerability
On the Certificate Management HTML pages for the Cisco VPN 3000 series concentrator it is possible for administrative users to observe the unencrypted certificate password in clear text upon viewing the source of the web page.
CSCdx07754 - XML public rule vulnerability
When a Cisco VPN 3000 series concentrator has the XML filter configuration enabled on its public interface, the configuration adds the rule "HTTPS on Public Inbound (XML-Auto)(forward/in)" to the public filter and sets the value for the protocol incorrectly to "ANY" and the value for the destination port to "443". The VPN concentrator checks the destination port field value only when the protocol is set to TCP or UDP. So enabling this filter configuration effectively allows any protocol on any port through the VPN Concentrator.
CSCdx24622 - HTML pages access vulnerability
Users can access a few Cisco VPN 3000 series concentrator HTML pages containing limited information without proper authentication.
CSCdx24632 - HTML login processing vulnerability
It is possible to cause the Cisco VPN 3000 series concentrator to reload by modifying an HTML file and posting very large strings as the username/password while accessing the HTML interface on the VPN concentrator.
CSCdx39981 - VPN client authentication vulnerability
When using a VPN client it is possible to cause the Cisco VPN 3000 series concentrator to reload by responding with a very large string for the username prompt.
CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability
The Cisco VPN 3000 series concentrator does not drop an incoming LAN-to-LAN connection even when it already has a security association for the same remote network with another device. Instead it disconnects the previously established connection and establishes a connection with the new device. The VPN concentrator also does not verify if the data coming across a LAN-to-LAN connection is being sourced from the correct network.
CSCdy38035 - ISAKMP packet processing vulnerability
Malformed or very large ISAKMP packets can cause device reloads in four instances:
-
Upon receipt of a malformed ISAKMP packet
-
Upon having debug turned on during the receipt of various
malformed packets
-
Upon receiving a very large number of payloads in an ISAKMP
packet
-
Upon having debug turned on while receiving large ISAKMP
packets.
These vulnerabilities are documented as Cisco bug ID's CSCdt56514, CSCdu15622, CSCdu35577, CSCdu82823, CSCdv66718, CSCdv88230, CSCdw22408, CSCdw50657, CSCdx07754, CSCdx24622, CSCdx24632, CSCdx39981, CSCdx54675 and CSCdy38035, which require a CCO account to view and can be viewed after 2002 September 4 at 1500 UTC.
-
Upon receipt of a malformed ISAKMP packet
-
Workarounds are described in this table.
DDTS - Description
Workarounds / Mitigation techniques
CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability
If possible use external authentication like TACACS+ or RADIUS.
CSCdu15622 - HTML parser processing vulnerability
Restrict access to the HTML interface such that connections are permitted only from trusted sources.
CSCdu35577 - Concentrator gives out too much information in application layer banners
There is no workaround.
CSCdu82823 - BSD sourced telnetd vulnerability
Restrict access to the telnet interface such that connections are permitted only from trusted sources.
CSCdv66718 - Windows PPTP client vulnerability
If possible configure the VPN 3000 series concentrator for IPSEC support only.
CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability
Restrict access to the HTML interface such that connections are permitted only from trusted sources.
CSCdw50657 - Certificate passwords visible with HTML view source vulnerability
Restrict access to the HTML interface such that connections are permitted only from trusted sources.
CSCdx07754 - XML public rule vulnerability
Remove any XML filter on the public interface.
CSCdx24622 - HTML pages access vulnerability
Restrict access to the HTML interface such that connections are permitted only from trusted sources.
CSCdx24632 - HTML login processing vulnerability
Restrict access to the HTML interface such that connections are permitted only from trusted sources.
CSCdx39981 - VPN client authentication vulnerability
There is no workaround.
CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability
There is no workaround.
CSCdy38035 - ISAKMP packet processing vulnerability
There is no workaround.
The Cisco PSIRT recommends that affected users upgrade to a fixed software version of code.
-
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance.
DDTS - Description
Fixed Releases
CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability
-
3.6.1 or later
-
3.5.5 or later
-
3.1.2 or later for 3.1.x releases
-
3.0.3(B) or later for 3.0.x releases
CSCdu15622 - HTML parser processing vulnerability
-
3.6(Rel) or later
-
3.5(Rel) or later
-
3.1(Rel) or later
-
3.0.3(B) or later
CSCdu35577 - Concentrator gives out too much information in application layer banners
-
3.6(Rel) or later
-
3.5.4 or later
CSCdu82823 - BSD sourced telnetd vulnerability
-
3.6(Rel) or later
-
3.5(Rel) or later
-
3.1(Rel) or later
-
3.0.4 or later
CSCdv66718 - Windows PPTP client vulnerability
-
3.6(Rel) or later
-
3.5(Rel) or later
-
3.1(Rel) or later
-
3.0(Rel) or later
-
2.5.2(F) or later
CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability
-
3.6(Rel) or later
-
3.5.1 or later
-
3.1.4 or later
CSCdw50657 - Certificate passwords visible with HTML view source vulnerability
-
3.6(Rel) or later
-
3.5.2 or later
CSCdx07754 - XML public rule vulnerability
-
3.6(Rel) or later
-
3.5.3 or later
CSCdx24622 - HTML pages access vulnerability
-
3.6(Rel) or later
-
3.5.3 or later
CSCdx24632 - HTML login processing vulnerability
-
3.6(Rel) or later
-
3.5.3 or later
CSCdx39981 - VPN client authentication vulnerability
-
3.6.1 or later
-
3.5.5 or later
CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability
-
3.6(Rel) or later
-
3.5.4 or later
CSCdy38035 - ISAKMP packet processing vulnerability
-
3.6.1 or later
-
3.5.5 or later
The procedure to upgrade to the fixed software version is detailed at http://www.cisco.com/univercd/cc/td/doc/product/vpn/vpn3000/vpn3kco/vcoug/usr_3_0/admin.htm#xtocid2259937.
-
3.6.1 or later
-
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
These vulnerabilities were reported to PSIRT by internal development testing and customers. The invalid ISAKMP packet length vulnerability addressed by CSCdy38035 was reported to the PSIRT by Phenoelit. The vulnerabilities addressed by CSCdx24622 and CSCdx24632 were reported to Cisco by Vigilante.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Revision 2.0
2002-September-03
Revised public release
Revision 1.0
2002-September-03
Initial public release
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.