ID

VAR-200608-0340

CVE

CVE-2006-4313

TITLE

Cisco VPN 3000 For changing files in the Series Concentrator CWD Command execution vulnerability

DESCRIPTION

Multiple unspecified vulnerabilities in Cisco VPN 3000 series concentrators before 4.1, 4.1.x up to 4.1(7)L, and 4.7.x up to 4.7(2)F allow attackers to execute the (1) CWD, (2) MKD, (3) CDUP, (4) RNFR, (5) SIZE, and (6) RMD FTP commands to modify files or create and delete directories via unknown vectors. The Cisco VPN 3000 series concentrators are prone to a vulnerability that allows attackers to access arbitrary files. An attacker can exploit this issue to rename and delete arbitrary files on the affected device in the context of the FTP server process. This may facilitate further attacks. The Cisco VPN Series Concentrators consist of a general-purpose remote-access virtual private network (VPN) platform and client software that combines high availability, performance, and scalability with today's most advanced encryption and authentication technologies for professional operations Provide services to merchants or enterprise users. * Change the configuration of the hub by renaming or deleting configuration and certificate files through RNFR and RMD FTP commands. Please note that since none of these vulnerabilities allow unauthorized users to upload or download files from the hub, it is not possible to obtain device configurations or upload modified configurations by exploiting these vulnerabilities. ---------------------------------------------------------------------- Hardcore Disassembler / Reverse Engineer Wanted! Want to work with IDA and BinDiff? Want to write PoC's and Exploits? Your nationality is not important. We will get you a work permit, find an apartment, and offer a relocation compensation package. http://secunia.com/hardcore_disassembler_and_reverse_engineer/ ---------------------------------------------------------------------- TITLE: Cisco VPN 3000 Concentrator FTP Management Vulnerabilities SECUNIA ADVISORY ID: SA21617 VERIFY ADVISORY: http://secunia.com/advisories/21617/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: >From local network OPERATING SYSTEM: Cisco VPN 3000 Concentrator http://secunia.com/product/90/ DESCRIPTION: Two vulnerabilities have been reported in Cisco VPN 3000 Concentrator, which can be exploited by malicious people to bypass certain security restrictions. This can e.g. be exploited to delete configuration files and certificates on the device. Successful exploitation requires that the device has been configured to use FTP as a management protocol (default setting). The vulnerabilities affect models 3005, 3015, 3020, 3030, 3060, and 3080 running the following versions: * Any version prior to 4.1 * Any 4.1.x version prior to, and including, 4.1(7)L * Any 4.7.x version prior to, and including, 4.7(2)F SOLUTION: Update to version 4.1(7)M or 4.7(2)G. http://www.cisco.com/pcgi-bin/tablebuild.pl/vpn3000-3des?psrtdcat20e2 Network security best practises recommend restricting access to the FTP service (or disabling it if not needed to manage the VPN 3000 concentrator). PROVIDED AND/OR DISCOVERED BY: The vendor credits NCC Group. ORIGINAL ADVISORY: http://www.cisco.com/warp/public/707/cisco-sa-20060823-vpn3k.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

access verification error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

NCC Group

SOURCES

LAST UPDATE DATE

2024-08-14T15:31:01.800000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE