Two vulnerabilities have been reported in Cisco VPN 3000 Concentrator, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerabilities are caused due to unspecified errors when using FTP as a management protocol and can be exploited to run the "CWD", "MKD", "CDUP", "RNFR", "SIZE", and "RMD" commands without being authenticated. This can e.g. be exploited to delete configuration files and certificates on the device.

Successful exploitation requires that the device has been configured to use FTP as a management protocol (default setting).

The vulnerabilities affect models 3005, 3015, 3020, 3030, 3060, and 3080 running the following versions:
* Any version prior to 4.1
* Any 4.1.x version prior to, and including, 4.1(7)L
* Any 4.7.x version prior to, and including, 4.7(2)F

Solution
Update to version 4.1(7)M or 4.7(2)G.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits NCC Group.

Changelog
Further details available in Customer Area

Original Advisory
http://www.cisco.com/warp/public/707/cisco-sa-20060823-vpn3k.shtml

Deep Links
Links available in Customer Area