CVE-2005-2025

Cisco VPN 3000 Concentrator before 4.1.7.F allows remote attackers to determine valid groupnames by sending an IKE Aggressive Mode packet with the groupname in the ID field, which generates a response if the groupname is valid, but does not generate a response for an invalid groupname.

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2005-06-20

Last modified

2024-08-07

Affected products

• Vpn 3000 Concentrator (Cisco)
• Vpn 3000 Concentrator Series Software (Cisco)
• Vpn 3005 Concentrator Software (Cisco)
• Vpn 3015 Concentrator (Cisco)
• Vpn 3020 Concentrator (Cisco)
• Vpn 3030 Concentator (Cisco)
• Vpn 3060 Concentrator (Cisco)
• Vpn 3080 Concentrator (Cisco)

References

• http://www.nta-monitor.com/news/vpn-flaws/cisco/VPN-Concentrator/index.htm
• http://www.securityfocus.com/bid/13992
• http://www.vupen.com/english/advisories/2005/0822