Cisco Patches VPN Vulnerability

A bug in Cisco's VPN Concentrator 3000 Series could leave the devices vulnerable to a DoS attack.

By  Michael Hall | Mar 31, 2005
Print ArticleEmail Article
  • Share on Facebook
  • Share on Twitter
  • Share on LinkedIn

Cisco's VPN Concentrator 3000 Series has a bug that could leave it vulnerable to a denial of service attack.

According to Cisco, the vulnerability is the result of an "unspecified error" within the device's SSL handling. It can be used to reload and/or drop user connections by sending specially crafted HTTPS packets to the device.

Cisco's report says that the concentrator's HTTPS service must be enabled (it's not by default) and accessible by a malicious user.

The vulnerability affects devices running software version 4.1.7.A and prior, and includes models 3005, 3015, 3020, 3030, 3060, 3080 and the Cisco VPN 3002 Hardware Client.

The company says an update to version 4.1.7.B of the concentrator's software will resolve the issue. It also offered two workarounds, noting that users can either disable the HTTPS service or block SSL traffic to the concentrator with a Transit ACL.

Details on how to obtain the update are available as part of Cisco's advisory.

mhall@internet.com

Comment and Contribute
(Maximum characters: 1200). You have
characters left.
Get the Latest Scoop with Enterprise Networking Planet Newsletter
Helpful Links

  • Yankee Group Mobile WAN Optimization Report

    Mobile work continues to evolve. Your organization must keep up with the demands of its mobile workforce. This report introduces the concept of mobile WAN optimization and provides three case studies including RCM, PRTM and Einstein that highlight how this emerging technology can help IT departments achieve what previously appeared to be conflicting goals. Read >

  • Network Security Resources

    More threats than ever before pose a danger to today's enterprise network. Get the latest tips and intel on the newest risks in our guide to network security resources. Read >

  • Extreme Savings: Cutting Costs with WAN Optimization

    Did you know it's possible to cut IT costs without impacting day-to-day IT operations? In fact, when you download this whitepaper from Riverbed on cost-savings through WAN optimization, you'll discover how businesses of all different sizes have realized a return on investment in just a few months through significant hard cost savings in areas such as bandwidth reduction and IT consolidation. It's called Extreme Savings and its only from Riverbed. Read >