---------------------------------------------------------------------- Hardcore Disassembler / Reverse Engineer Wanted! Want to work with IDA and BinDiff? Want to write PoC's and Exploits? Your nationality is not important. We will get you a work permit, find an apartment, and offer a relocation compensation package. http://secunia.com/hardcore_disassembler_and_reverse_engineer/ ---------------------------------------------------------------------- TITLE: Cisco VPN 3000 Concentrator FTP Management Vulnerabilities SECUNIA ADVISORY ID: SA21617 VERIFY ADVISORY: http://secunia.com/advisories/21617/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: >From local network OPERATING SYSTEM: Cisco VPN 3000 Concentrator http://secunia.com/product/90/ DESCRIPTION: Two vulnerabilities have been reported in Cisco VPN 3000 Concentrator, which can be exploited by malicious people to bypass certain security restrictions. The vulnerabilities are caused due to unspecified errors when using FTP as a management protocol and can be exploited to run the "CWD", "MKD", "CDUP", "RNFR", "SIZE", and "RMD" commands without being authenticated. This can e.g. be exploited to delete configuration files and certificates on the device. Successful exploitation requires that the device has been configured to use FTP as a management protocol (default setting). The vulnerabilities affect models 3005, 3015, 3020, 3030, 3060, and 3080 running the following versions: * Any version prior to 4.1 * Any 4.1.x version prior to, and including, 4.1(7)L * Any 4.7.x version prior to, and including, 4.7(2)F SOLUTION: Update to version 4.1(7)M or 4.7(2)G. http://www.cisco.com/pcgi-bin/tablebuild.pl/vpn3000-3des?psrtdcat20e2 Network security best practises recommend restricting access to the FTP service (or disabling it if not needed to manage the VPN 3000 concentrator). PROVIDED AND/OR DISCOVERED BY: The vendor credits NCC Group. ORIGINAL ADVISORY: http://www.cisco.com/warp/public/707/cisco-sa-20060823-vpn3k.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------