Security Advisory: Cisco VPN 5000 Series Concentrator RADIUS PAP Authentication Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco VPN 5000 Series Concentrator RADIUS PAP Authentication Vulnerability Revision 1.0 For Public Release 2002 August 07 UTC 1500 Contents Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed...

Cisco RADIUS PAP-authentication cleartext password

In case of failed authentication password is sent in cleartext...

Cisco VPN 5000 Series Concentrator RADIUS PAP Authentication Vulnerability

...

CVE-2001-1376

CVE-2001-1376 describes a buffer overflow in the RADIUS digest calculation function across multiple implementations. The overflow occurs while concatenating the shared secret with the received packet during digest computation, enabling remote denial of service and, in some cases, arbitrary code e...

CVE-2001-1377

CVE-2001-1377 affects multiple RADIUS implementations that fail to validate the Vendor-Length of Vendor-Specific attributes, enabling a remote attacker to crash the server when Vendor-Length

CVE-2001-1376

Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via shared secret data...

CVE-2001-1377

Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service crash via a Vendor-Length that is less than 2...

Vulnerabilities in Various Implementations of the RADIUS Protocol

CERT Advisory CA-2002-06 Vulnerabilities in Various Implementations of the RADIUS Protocol Original release date: March 4, 2002 Last revised: -- Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected Systems running any of the following RADIUS...

CVE-2001-1377

Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service crash via a Vendor-Length that is less than 2...

CVE-2001-1376

Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via shared secret data...

SECURITY.NNOV: few vulnerabilities in multiple RADIUS implementations

Topic : Vulnerabilities in multiple RADIUS clients and servers Author : 3APA3A [email protected] Released : December, 18 2001 Public release : March, 04 2002 Affected Software : Cistron = 1.6.4 12 Cistron 1.6.5 2 XtRadius = 1.1-pre1 12 FreeRADIUS = 0.3 12 ICRadius = 0.18.1 12 YARD Radius =...

Multiple implementations of the RADIUS protocol contain a digest calculation buffer overflow

Overview Multiple implementations of the RADIUS protocol contain a buffer overflow in the function that calculates message digests. Description During the message digest calculation, a string containing the shared secret is concatenated with a packet received without checking the size of the targ...

Multiple implementations of the RADIUS protocol do not adequately validate the vendor-length of the vendor-specific attributes

Overview Various RADIUS servers and clients permit the passing of vendor-specific and user-specific attributes. Several implementations of RADIUS fail to check the Vendor-Length of the Vendor-Specific attribute. It's possible to cause a denial of service against RADIUS servers with a malformed...

CVE-2001-1000

The CVE-2001-1000 issue affects Merit AAA Server’s rlmadmin RADIUS management utility (versions including 3.8M and 5.01). The vulnerability arises from a symlink attack on the rlmadmin.help file, allowing local users to read arbitrary files. The documented impact is local access with partial conf...

CVE-2001-1000

rlmadmin RADIUS management utility in Merit AAA Server 3.8M, 5.01, and possibly other versions, allows local users to read arbitrary files via a symlink attack on the rlmadmin.help file...

CVE-2001-1082

Directory traversal vulnerability in Livingston/Lucent RADIUS before 2.1.va.1 may allow attackers to read arbitrary files via a .. dot dot attack...

CVE-2001-1082

CVE-2001-1082 describes a directory traversal vulnerability in Livingston/Lucent RADIUS prior to 2.1.va.1, allowing an attacker to read arbitrary files via a .. (dot dot) path traversal attack. Affected component is the RADIUS service; root cause is improper input validation in file access logic....

Vulnerabilities in multiple RADIUS clients and servers

Topic : Vulnerabilities in multiple RADIUS clients and servers Author : 3APA3A Released : December, 18 2001 Affected Software : Lucent/Livingston RADIUS 3= 2.1 12? Cistron 3= 1.6.4 12 Cistron 1.6.5 2 XtRadius 3= 1.1-pre1 12 FreeRADIUS 3= 0.3 12 ICRadius 3= 0.18.1 12 YARD Radius 3= 1.0.19 12 Ascen...

Secure Computing SafeWord uses vulnerable ssh server

Secure Computing's SafeWord PremierAccess product earlier known as SafeWord Plus is an access control system capable of using several different authentication mechanisms for controlling access to network resources. The most used mechanism is one time passwords, generated by hardware or software...

more RADIUS authentication attack scenarios

Hello bugtraq, There is also problem with some vendor-specific RADIUS authentication implementation. For example Microsoft has it's specific attributes defined in RFC 2548. These attributes allow MS-CHAP and MS-CHAPv2 authentication via RADIUS. There is design flow in this authentication scenario...