Cisco VPN 3000 Concentrator denial of service
| cisco-vpn-3000-dos (19903) |  Low Risk |
Description:
Cisco VPN 3000 series concentrators are vulnerable to a denial of service attack, caused by a vulnerability in the SSL (Secure Socket Layer) protocol. By sending malicious HTTPS packets, a remote attacker could cause the Cisco VPN 3000 series concentrators to reload and/or drop user connections, resulting in a denial of service. An attacker could repeat exploitation of this vulnerability to cause a sustained denial of service.
Note: In order to exploit this vulnerability, the HTTPS service must be enabled (not enabled by default) and access to the service must not be limited to only trusted hosts or network workstations.
Platforms Affected:
- Cisco, VPN 3000 Concentrator 2.0
- Cisco, VPN 3000 Concentrator 2.5.2.A
- Cisco, VPN 3000 Concentrator 2.5.2.B
- Cisco, VPN 3000 Concentrator 2.5.2.C
- Cisco, VPN 3000 Concentrator 2.5.2.D
- Cisco, VPN 3000 Concentrator 2.5.2.F
- Cisco, VPN 3000 Concentrator 3.0
- Cisco, VPN 3000 Concentrator 3.0.3.A
- Cisco, VPN 3000 Concentrator 3.0.3.B
- Cisco, VPN 3000 Concentrator 3.0.4
- Cisco, VPN 3000 Concentrator 3.1
- Cisco, VPN 3000 Concentrator 3.1(Rel)
- Cisco, VPN 3000 Concentrator 3.1.1
- Cisco, VPN 3000 Concentrator 3.1.2
- Cisco, VPN 3000 Concentrator 3.1.4
- Cisco, VPN 3000 Concentrator 3.5(Rel)
- Cisco, VPN 3000 Concentrator 3.5.1
- Cisco, VPN 3000 Concentrator 3.5.2
- Cisco, VPN 3000 Concentrator 3.5.3
- Cisco, VPN 3000 Concentrator 3.5.4
- Cisco, VPN 3000 Concentrator 3.5.5
- Cisco, VPN 3000 Concentrator 3.6
- Cisco, VPN 3000 Concentrator 3.6.1
- Cisco, VPN 3000 Concentrator 3.6.7
- Cisco, VPN 3000 Concentrator 3.6.7D
- Cisco, VPN 3000 Concentrator 4.0
- Cisco, VPN 3000 Concentrator 4.0.1
- Cisco, VPN 3000 Concentrator 4.0.5.B
- Cisco, VPN 3000 Concentrator 4.1
- Cisco, VPN 3000 Concentrator 4.1.5.B
- Cisco, VPN 3000 Concentrator 4.1.7.A
- Cisco, VPN 3002 Hardware Client
- Cisco, VPN 3005 Concentrator 3.6.3
- Cisco, VPN 3005 Concentrator 3.6.5
- Cisco, VPN 3005 Concentrator 3.6.7
- Cisco, VPN 3005 Concentrator 3.6.7.A
- Cisco, VPN 3005 Concentrator 3.6.7.B
- Cisco, VPN 3005 Concentrator 3.6.7.C
- Cisco, VPN 3005 Concentrator 3.6.7.D
- Cisco, VPN 3005 Concentrator 3.6.7.F
- Cisco, VPN 3005 Concentrator 4.0
- Cisco, VPN 3005 Concentrator 4.0.1
- Cisco, VPN 3015 Concentrator
- Cisco, VPN 3020 Concentrator
- Cisco, VPN 3030 Concentator
- Cisco, VPN 3060 Concentrator
- Cisco, VPN 3080 Concentrator
Remedy:
Upgrade to the latest version of Cisco VPN 3000 series software (4.1.7.B or later), as listed in Cisco Security Advisory 2005 March 30 1600 UTC (GMT). See References.
As a workaround, disable the HTTPS by following the instructions, as listed in Cisco Security Advisory 2005 March 30 1600 UTC (GMT). See References.
Consequences:
Denial of Service
References:
- Cisco Systems Inc. Security Advisory, 2005 March 30 1600 UTC (GMT), Cisco VPN 3000 Concentrator Vulnerable to Crafted SSL Attack at http://www.cisco.com/warp/public/707/cisco-sa-20050330-vpn3k.shtml.
- BID-12948: Cisco VPN 3000 Concentrator Remote Denial of Service Vulnerability
- CVE-2005-0943: Cisco VPN 3000 series Concentrator running firmware 4.1.7.A and earlier allows remote attackers to cause a denial of service (device reload or drop user connection) via a crafted HTTPS packet.
- SA14784: Cisco VPN Concentrator 3000 Series HTTPS Packet Denial of Service
Reported:
Mar 30, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net