A vulnerability in the implementation of RSA-encrypted nonces in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote malicious user to obtain the encrypted nonces of an Internet Key Exchange Version 1 (IKEv1) session. The vulnerability exists because the affected software responds incorrectly to decryption failures. An attacker could exploit this vulnerability sending crafted ciphertexts to a device configured with IKEv1 that uses RSA-encrypted nonces. A successful exploit could allow the malicious user to obtain the encrypted nonces. Cisco Bug IDs: CSCve77140.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
cisco ios xe 15.5\\(3\\)s |
||
cisco ios 15.5\\(3\\)s |
Ancient issue causing new ones IPv6 and 5G will make life hell for spooks and cops say Australia's spooks and cops
Security gaps have been identified in widely used implementations of the IPsec protocol, which is used in the set up of Virtual Private Networks (VPNs). The Internet Key Exchange protocol "IKEv1", which is part of the IPsec protocol family, has vulnerabilities that enable potential attackers to interfere with the communication process and snoop of supposedly encrypted traffic. IKEv1 was superseded by IKEv2 years ago the obsolete protocol is still widely used and supported - even by newer devices...
Switchzilla issues update for authentication bypass flaw Cisco let an SSL cert expire in its VPN kit – and broke network provisioning brokers
Cisco has pushed out an update for its internetwork operating system (IOS) and IOS XE firmware in advance of a Usenix presentation on circumventing cryptographic key protocol. The networking behemoth is advising all customers running hardware that uses IOS and IOS XE to get the updates that address CVE-2018-0131, a security bypass vulnerability stemming from a weakness in the Internet Key Exchange (IKEv1) protocol. Researchers Dennis Felsch, Martin Grothe, Jörg Schwenk, Adam Czubak, and Marcin ...
Vulmon