OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
[ISN] Cisco warns of hijack code for VPN gear

From: InfoSec News (isnc4i.org)
Date: Wed Apr 21 2004 - 06:15:56 CDT

http://www.nwfusion.com/news/2004/0420ciswarn.html

By Phil Hochmuth
Network World Fusion
04/20/04

Cisco last week warned that hacker software now exists that allows
attackers to break into a Cisco-based VPN by intercepting VPN
logon/password data.

The hacker code takes advantage of a previously reported vulnerability
in Cisco VPN hardware and software, where Group Passwords are used
instead of Public Key Infrastructure (PKI) certificates to
authenticate a VPN user. The exploit code affects the Cisco VPN 3000
Concentrator, the Cisco VPN client software for Windows and Linux PCs,
and the VPN 3002 hardware client - a small appliance for connecting
remote PCs to a Cisco VPN through broadband links.

The exploit code could be used to emulate an enterprise VPN
termination device, such as the Cisco VPN Concentrator, and glean VPN
usernames and passwords from end users. The code could also be used to
hijack Cisco VPN connections directly from end users.

According to a Cisco statement, "the Group Password used by the Cisco
IPSec VPN client is scrambled on the hard drive, but unscrambled in
memory. This password can now be recovered on both the Linux and
Microsoft Windows platform implementations of the Cisco IPSec VPN
client."

This so-called "man-in-the-middle" attack only affects Cisco VPN gear
using Group Passwords. This is considered a less-secure authentication
method than PKI certificate exchanges.

Cisco says there are no workarounds for this problem, and recommends
that users implement PKI instead of Group Passwords for VPN
authentication. The company says it will release software that will
fix the Group Password problem on the VPN 3000 Concentrator, client
software and hardware client in the third quarter of this year.

The news of hacker software for this Cisco VPN weakness comes a week
after Cisco warned of a software flaw that could leave the IPSec VPN
Module for the Catalyst 6500 switch and 7600 series router susceptible
to a denial-of-service attack.

_________________________________________
ISN mailing list
Sponsored by: OSVDB.org