Cisco VPN 3000 Concentrator Multiple Vulnerabilities

Summary

• The Cisco VPN 3000 series concentrators are a family of purpose-built, remote access Virtual Private Network (VPN) platforms for data encryption and authentication.

  This advisory documents multiple vulnerabilities for the Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client. These vulnerabilities are documented as Cisco bug ID's CSCdt56514, CSCdu15622, CSCdu35577, CSCdu82823, CSCdv66718, CSCdv88230, CSCdw22408, CSCdw50657, CSCdx07754, CSCdx24622, CSCdx24632, CSCdx39981, CSCdx54675 and CSCdy38035. Upgrading to the latest version of code for the Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client, version 3.5.5 or 3.6.1, would protect against all of these documented vulnerabilities.

  This advisory will be posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20020903-vpn3k-vulnerability.

Affected Products

• This section provides details on affected products.

  Vulnerable Products

  The Cisco VPN 3000 series concentrators are affected by these vulnerabilities. This series includes models 3005, 3015, 3030, 3060, 3080 and the Cisco VPN 3002 Hardware Client.

  DDTS - Description	Affected Releases
  CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability	3.6(Rel) 3.5(Rel) to 3.5.4 earlier than 3.1.2 earlier than 3.0.3(B) 2.x.x
  CSCdu15622 - HTML parser processing vulnerability	earlier than 3.0.3(B) 2.x.x
  CSCdu35577 - Concentrator gives out too much information in application layer banners	earlier than 3.5.4 3.1.x 3.0.x 2.x.x
  CSCdu82823 - BSD sourced telnetd vulnerability	earlier than 3.0.4 2.x.x
  CSCdv66718 - Windows PPTP client vulnerability	earlier than 2.5.2(F)
  CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability	earlier than 3.5.1 earlier than 3.1.4 3.0.x 2.x.x
  CSCdw50657 - Certificate passwords visible with HTML view source vulnerability	earlier than 3.5.2 3.1.x 3.0.x 2.x.x
  CSCdx07754 - XML public rule vulnerability	earlier than 3.5.3 3.1.x 3.0.x 2.x.x
  CSCdx24622 - HTML pages access vulnerability	earlier than 3.5.3 3.1.x 3.0.x 2.x.x
  CSCdx24632 - HTML login processing vulnerability	earlier than 3.5.3 3.1.x 3.0.x 2.x.x
  CSCdx39981 - VPN client authentication vulnerability	3.6(Rel) earlier than 3.5.5 3.1.x 3.0.x 2.x.x
  CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability	earlier than 3.5.4 3.1.x 3.0.x 2.x.x
  CSCdy38035 - ISAKMP packet processing vulnerability	3.6(Rel) earlier than 3.5.5 3.1.x 3.0.x 2.x.x

  To determine if a Cisco VPN 3000 series concentrator is running affected software, check the software revision via the web interface or the console menu.

  Products Confirmed Not Vulnerable

  These vulnerabilities do not affect the VPN Client software nor the Cisco VPN 5000 series concentrators. No other Cisco product is known to be affected by these vulnerabilities.

Details

• This section provides details about the vulnerabilities described in this document.

  DDTS - Description	Details
  CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability	If a Cisco VPN 3000 series concentrator is set up for internal authentication with only group accounts configured and no user accounts configured, then a VPN client logging in using PPTP or IPSEC user authentication succeeds by using a group name/password as login credentials. For VPN client connections using IPSEC user authentication, the Cisco VPN series concentrator will not allow the VPN client to use the same group name/password as what is configured in the VPN client's connection properties, but if another group account exists on the concentrator, then using its group name/password the VPN client can authenticate to the VPN concentrator. The Cisco VPN 3002 Hardware Client does not support PPTP or incoming connections and therefore is not vulnerable to this problem.
  CSCdu15622 - HTML parser processing vulnerability	Very long URL requests to the HTML interface cause the VPN 3000 series concentrator to stop responding. The CPU on the Cisco VPN concentrator jumps to 100%. The IP stack of the VPN concentrator stops responding. The VPN concentrator recovers approximately five minutes after the DoS attack is stopped.
  CSCdu35577 - Concentrator gives out too much information in application layer banners	The Cisco VPN 3000 series concentrators give out too much information in application layer banners. The SSH banner gives out information about the device apart from the SSH version numbers. The FTP banner gives information about the device and the local time. An incorrect HTTP page request gives out information about the device, the name of the person who compiled the software and the time of compilation.
  CSCdu82823 - BSD sourced telnetd vulnerability	Cisco VPN 3000 series concentrators run telnetd daemon code derived from the BSD source and are vulnerable to a buffer overflow in the telnet option handling, which can cause the telnet daemon to crash and result in a VPN concentrator reload. This vulnerability is also documented as CERT Advisory CA-2001-21. Telnet is not permitted on the public interface of the VPN concentrator in the default configuration and is never permitted on the public interface of the VPN 3002 Hardware Client.
  CSCdv66718 - Windows PPTP client vulnerability	Windows native PPTP clients connecting with the No Encryption option set can cause the Cisco VPN 3000 series concentrator, with encryption set, to reload.
  CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability	On password containing HTML pages for the Cisco VPN 3000 series concentrator it is possible for restricted access administrative users to observe the password in clear text upon viewing the source of the web page without having the appropriate level of administrative access.
  CSCdw50657 - Certificate passwords visible with HTML view source vulnerability	On the Certificate Management HTML pages for the Cisco VPN 3000 series concentrator it is possible for administrative users to observe the unencrypted certificate password in clear text upon viewing the source of the web page.
  CSCdx07754 - XML public rule vulnerability	When a Cisco VPN 3000 series concentrator has the XML filter configuration enabled on its public interface, the configuration adds the rule "HTTPS on Public Inbound (XML-Auto)(forward/in)" to the public filter and sets the value for the protocol incorrectly to "ANY" and the value for the destination port to "443". The VPN concentrator checks the destination port field value only when the protocol is set to TCP or UDP. So enabling this filter configuration effectively allows any protocol on any port through the VPN Concentrator.
  CSCdx24622 - HTML pages access vulnerability	Users can access a few Cisco VPN 3000 series concentrator HTML pages containing limited information without proper authentication.
  CSCdx24632 - HTML login processing vulnerability	It is possible to cause the Cisco VPN 3000 series concentrator to reload by modifying an HTML file and posting very large strings as the username/password while accessing the HTML interface on the VPN concentrator.
  CSCdx39981 - VPN client authentication vulnerability	When using a VPN client it is possible to cause the Cisco VPN 3000 series concentrator to reload by responding with a very large string for the username prompt.
  CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability	The Cisco VPN 3000 series concentrator does not drop an incoming LAN-to-LAN connection even when it already has a security association for the same remote network with another device. Instead it disconnects the previously established connection and establishes a connection with the new device. The VPN concentrator also does not verify if the data coming across a LAN-to-LAN connection is being sourced from the correct network.
  CSCdy38035 - ISAKMP packet processing vulnerability	Malformed or very large ISAKMP packets can cause device reloads in four instances: Upon receipt of a malformed ISAKMP packet Upon having debug turned on during the receipt of various malformed packets Upon receiving a very large number of payloads in an ISAKMP packet Upon having debug turned on while receiving large ISAKMP packets.

  These vulnerabilities are documented as Cisco bug ID's CSCdt56514, CSCdu15622, CSCdu35577, CSCdu82823, CSCdv66718, CSCdv88230, CSCdw22408, CSCdw50657, CSCdx07754, CSCdx24622, CSCdx24632, CSCdx39981, CSCdx54675 and CSCdy38035, which require a CCO account to view and can be viewed after 2002 September 4 at 1500 UTC.

Workarounds

• Workarounds are described in this table.

  DDTS - Description	Workarounds / Mitigation techniques
  CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability	If possible use external authentication like TACACS+ or RADIUS.
  CSCdu15622 - HTML parser processing vulnerability	Restrict access to the HTML interface such that connections are permitted only from trusted sources.
  CSCdu35577 - Concentrator gives out too much information in application layer banners	There is no workaround.
  CSCdu82823 - BSD sourced telnetd vulnerability	Restrict access to the telnet interface such that connections are permitted only from trusted sources.
  CSCdv66718 - Windows PPTP client vulnerability	If possible configure the VPN 3000 series concentrator for IPSEC support only.
  CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability	Restrict access to the HTML interface such that connections are permitted only from trusted sources.
  CSCdw50657 - Certificate passwords visible with HTML view source vulnerability	Restrict access to the HTML interface such that connections are permitted only from trusted sources.
  CSCdx07754 - XML public rule vulnerability	Remove any XML filter on the public interface.
  CSCdx24622 - HTML pages access vulnerability	Restrict access to the HTML interface such that connections are permitted only from trusted sources.
  CSCdx24632 - HTML login processing vulnerability	Restrict access to the HTML interface such that connections are permitted only from trusted sources.
  CSCdx39981 - VPN client authentication vulnerability	There is no workaround.
  CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability	There is no workaround.
  CSCdy38035 - ISAKMP packet processing vulnerability	There is no workaround.

  The Cisco PSIRT recommends that affected users upgrade to a fixed software version of code.

Fixed Software

• When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.

  In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance.

  DDTS - Description	Fixed Releases
  CSCdt56514 - PPTP, IPSEC internal authentication login vulnerability	3.6.1 or later 3.5.5 or later 3.1.2 or later for 3.1.x releases 3.0.3(B) or later for 3.0.x releases
  CSCdu15622 - HTML parser processing vulnerability	3.6(Rel) or later 3.5(Rel) or later 3.1(Rel) or later 3.0.3(B) or later
  CSCdu35577 - Concentrator gives out too much information in application layer banners	3.6(Rel) or later 3.5.4 or later
  CSCdu82823 - BSD sourced telnetd vulnerability	3.6(Rel) or later 3.5(Rel) or later 3.1(Rel) or later 3.0.4 or later
  CSCdv66718 - Windows PPTP client vulnerability	3.6(Rel) or later 3.5(Rel) or later 3.1(Rel) or later 3.0(Rel) or later 2.5.2(F) or later
  CSCdv88230, CSCdw22408 - User passwords visible with HTML view source vulnerability	3.6(Rel) or later 3.5.1 or later 3.1.4 or later
  CSCdw50657 - Certificate passwords visible with HTML view source vulnerability	3.6(Rel) or later 3.5.2 or later
  CSCdx07754 - XML public rule vulnerability	3.6(Rel) or later 3.5.3 or later
  CSCdx24622 - HTML pages access vulnerability	3.6(Rel) or later 3.5.3 or later
  CSCdx24632 - HTML login processing vulnerability	3.6(Rel) or later 3.5.3 or later
  CSCdx39981 - VPN client authentication vulnerability	3.6.1 or later 3.5.5 or later
  CSCdx54675 - LAN-to-LAN IPSEC tunnel vulnerability	3.6(Rel) or later 3.5.4 or later
  CSCdy38035 - ISAKMP packet processing vulnerability	3.6.1 or later 3.5.5 or later

  The procedure to upgrade to the fixed software version is detailed at http://www.cisco.com/univercd/cc/td/doc/product/vpn/vpn3000/vpn3kco/vcoug/usr_3_0/admin.htm#xtocid2259937.

Exploitation and Public Announcements

• The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

  These vulnerabilities were reported to PSIRT by internal development testing and customers. The invalid ISAKMP packet length vulnerability addressed by CSCdy38035 was reported to the PSIRT by Phenoelit. The vulnerabilities addressed by CSCdx24622 and CSCdx24632 were reported to Cisco by Vigilante.

URL

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20020903-vpn3k-vulnerability

Revision History

• Revision 2.0	2002-September-03	Revised public release
  Revision 1.0	2002-September-03	Initial public release

  Show Less