 A vulnerability has been reported in Cisco VPN Concentrator 3000 Series, which can be exploited by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to an unspecified error within the SSL handling and can be exploited to cause a vulnerable device to reload and/or drop user connections by sending specially crafted HTTPS packets to the device.
Successful exploitation requires that the HTTPS service is enabled (not enabled by default) and can be accessed by the malicious person.
The vulnerability affects devices running software version 4.1.7.A and prior.
OPERATING SYSTEM:
Cisco VPN 3002 Hardware Client 4.x
Cisco VPN 3002 Hardware Client 3.x
Cisco VPN 3000 Concentrator
SOLUTION:
Update to software version 4.1.7.B or later.
Only trusted hosts and network management workstations should be able
to access the HTTPS web management interface.
PROVIDED AND/OR DISCOVERED BY:
Reported by vendor.
ORIGINAL ADVISORY:
http://www.cisco.com/warp/public/707/cisco-sa-20050330-vpn3k.shtml
VERIFY ADVISORY:
http://secunia.com/advisories/14784/
Secunia Security Advisories
| 
Contribute :
Advanced Search :
Web Resources :
Polls :
File Repository
