|
Cisco IPsec VPN Implementation Group/User Password Disclosure
|
|
Secunia Advisory:
|
SA11387
|
|
|
Release Date:
|
2004-04-16
|
|
Last Update:
|
2005-10-18
|
|
Popularity:
|
14,674 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Exposure of sensitive information
|
|
Where:
|
Local system
|
|
Solution Status:
|
Vendor Workaround
|
|
| OS: | Cisco VPN 3000 Concentrator
Cisco VPN 3002 Hardware Client 3.x
Cisco VPN 3002 Hardware Client 4.x
|
|
| Software: | Cisco VPN Client 2.x
Cisco VPN Client 3.x
Cisco VPN Client 4.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
Description:
Two security issues have been reported in the Cisco's IPsec VPN implementation, which can be exploited by malicious, local users to gain knowledge of sensitive information.
1) The Group Authentication password is stored in memory in cleartext.
2) The Group Authentication and users' saved passwords are stored in ".pcf" profile files, which are readable by other local users. The passwords can be decrypted using a derivable encryption key.
Malicious users who have gained knowledge of a Group Authentication password may use these to hijack connections or gain knowledge of sensitive information when these are used as pre-shared keys during authentication.
NOTE: A tool to decrypt Group Authentication and users' passwords in ".pcf" files has been released.
Solution:
Cisco recommends that customers deploy PKI (Public Key Infrastructure) instead of a Group Password based authentication scheme.
http://www.cisco.com/warp/public/cc/so/cuso/epso/sqfr/safev_wp.htm
Configure the VPN client to not allow users to save their passwords locally. Restrict access to systems that have the VPN client installed.
Provided and/or discovered by:
1) Karl Gaissmaier, Jonas Eriksson, and Nicholas Kathmann.
2) HAL 9000
Changelog:
2005-10-18: Added information about additional security issue. Updated description, solution, and original advisory.
Original Advisory:
CISCO:
http://www.cisco.com/warp/public/707/cisco-sn-20040415-grppass.shtml
HAL 9000:
http://evilscientists.de/blog/?page_id=343
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
