search menu icon-carat-right cmu-wordmark
Carnegie Mellon University

Software Engineering Institute

CERT Coordination Center

Cisco VPN 3000 Concentrator vulnerable to DoS via large number of malformed ICMP packets

Vulnerability Note VU#221164

Original Release Date: 2003-06-23 | Last Revised: 2003-06-23

Overview

A vulnerability in some Cisco Virtual Private Network (VPN) products could allow a remote attacker to cause a denial of service.

Description

The Cisco VPN 3000 Series Concentrators and the Cisco VPN 3002 Hardware Clients are Virtual Private Network (VPN) platforms designed to provide secure remote network access. Some models of these devices contain a vulnerability by which a flood of malformed ICMP packets could result in performance degradation or cause the affected device to reboot.

Impact

A denial-of-service condition can result from degraded performance or unexpected rebooting of the affected device.

Solution

Cisco Systems Inc. has released software patches and workaround information for this vulnerability. Please see the vendor information section of this document for more details.

Workarounds

Filter malformed ICMP packets on network devices that are upstream from the affected VPN Concentrator device. Sites may wish to apply this workaround in conjunction with the application of the recommended patches. As a general rule, the CERT/CC recommends that sites block all types of network traffic that are not explicitly required for normal operation.

Vendor Information

221164
 
Expand all

Cisco Systems Inc. Affected

Updated:  May 08, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Cisco Systems Inc. has released Cisco Security Advisory 20030507-vpn3k in response to this issue. Users are encouraged to review this advisory and apply the patches and workarounds it recommends.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base
Temporal
Environmental

References

Acknowledgements

Thanks to Cisco Systems Product Security Incident Response Team for reporting this vulnerability.

This document was written by Chad R Dougherty.

Other Information

CVE IDs: CVE-2003-0260
Severity Metric: 11.81
Date Public: 2003-05-07
Date First Published: 2003-06-23
Date Last Updated: 2003-06-23 18:13 UTC
Document Revision: 12

Sponsored by CISA.

Download PGP Key

Read CERT/CC Blog

Learn about Vulnerability Analysis