CERTA-2002-AVI-188
Vulnerability from certfr_avis

Trois vulnérabilités ont été découvertes dans le client VPN de CISCO.

Description

Le client VPN (Virtual Private Network) permet d'établir des tunnels chiffrés entre le système local et un concentrateur VPN. Celui-ci garantit la confidentialité et l'intégrité des données qu'il transporte.

Trois vulnérabilités sont présentes dans ce client :

  • Deux débordements de mémoire permettent à un individu mal intentionné d'exécuter du code arbitraire ;
  • l'envoi de paquets malicieusement construits permet d'effectuer un déni de service.

Solution

Appliquer le correctif (cf. Documentation).

Tous les clients VPN CISCO antérieurs aux versions 3.6 et 3.5.4.

Impacted products
Vendor Product Description
References

Show details on source website


{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eTous les clients VPN CISCO ant\u00e9rieurs aux versions 3.6 et  3.5.4.\u003c/P\u003e",
  "content": "## Description\n\nLe client VPN (Virtual Private Network) permet d\u0027\u00e9tablir des tunnels\nchiffr\u00e9s entre le syst\u00e8me local et un concentrateur VPN. Celui-ci\ngarantit la confidentialit\u00e9 et l\u0027int\u00e9grit\u00e9 des donn\u00e9es qu\u0027il transporte.\n\nTrois vuln\u00e9rabilit\u00e9s sont pr\u00e9sentes dans ce client :\n\n-   Deux d\u00e9bordements de m\u00e9moire permettent \u00e0 un individu mal\n    intentionn\u00e9 d\u0027ex\u00e9cuter du code arbitraire ;\n-   l\u0027envoi de paquets malicieusement construits permet d\u0027effectuer un\n    d\u00e9ni de service.\n\n## Solution\n\nAppliquer le correctif (cf. Documentation).\n",
  "cves": [],
  "initial_release_date": "2002-08-23T00:00:00",
  "last_revision_date": "2002-08-23T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 CISCO \"Cisco VPN Client Multiple  Vulnerabilities\" :",
      "url": "http://www.cisco.com/warp/public/707/vpnclient-multiple-vuln-pub.shtml"
    }
  ],
  "reference": "CERTA-2002-AVI-188",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2002-08-23T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "D\u00e9ni de service"
    }
  ],
  "summary": "Trois vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le client VPN de CISCO.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans le client VPN CISCO",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de securite CISCO",
      "url": null
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…