Cisco VPN 3000 Concentrator may allow access to internal hosts when IPsec over TCP is enabled

Overview

A vulnerability in some Cisco Virtual Private Network (VPN) products could allow a remote attacker to access systems that should not be accessible.

Description

The Cisco VPN 3000 Series Concentrators and the Cisco VPN 3002 Hardware Clients are Virtual Private Network (VPN) platforms designed to provide secure remote network access. Some models of these devices contain a vulnerability by which a TCP port selected for forwarding IPsec over TCP traffic is forwarded to all systems on the protected network and not just the systems using IPsec. This may allow an attacker to access services that should not be accessible from the public network without authentication of any sort.

---

Impact

A remote attacker may be able to gain unintended access to the private network on the affected device. Attackers could leverage this access to exploit additional, unrelated vulnerabilities in services that use the same TCP port as that used to tunnel the IPsec traffic.

---

Solution

Cisco Systems Inc. has released software patches and workaround information for this vulnerability. Please see the vendor information section of this document for more details.

---

Workarounds

Cisco recommends adding rules to the filter for the private interface that restrict outgoing traffic on ports configured for use by IPsec over TCP on the VPN concentrator. This would not stop the traffic from the public network reaching the VPN 3000 concentrator itself but would prevent the traffic from reaching the servers on the private network.

If patches cannot be applied, sites may wish to select a less-commonly used TCP port for the IPsec tunnel to limit the services that might be available to attack over the tunnel.

---

Vendor Information

727780

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Cisco Systems Inc. __ Affected

Updated: May 08, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Cisco Systems Inc. has released Cisco Security Advisory 20030507-vpn3k in response to this issue. Users are encouraged to review this advisory and apply the patches and workarounds it recommends.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23727780 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.cisco.com/warp/public/707/cisco-sa-20030507-vpn3k.shtml&gt;
• <http://www.iss.net/security_center/static/11954.php&gt;

Acknowledgements

Thanks to Cisco Systems Product Security Incident Response Team for reporting this vulnerability.

This document was written by Chad R Dougherty.

Other Information

CVE IDs:	CVE-2003-0258
Severity Metric:	23.73 Date Public: