PT-2004-3511 · Nortel · Nortel Contivity Vpn Client

Publicado 2004-12-31 · Atualizado 2017-07-20 · CVE-2004-2621

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Nortel Contivity VPN Client versions 2.1.7, 3.00, 3.01, 4.91, and 5.01

Description The issue allows remote attackers to perform a man-in-the-middle (MITM) attack due to a race condition. This occurs when the VPN client does not check the gateway certificate until after a dialog box has been displayed to the user, while opening a VPN tunnel.

Recommendations For versions 2.1.7, 3.00, 3.01, 4.91, and 5.01, consider disabling the automatic establishment of VPN tunnels until a patch is available, to minimize the risk of exploitation. Restrict access to sensitive resources when using the affected VPN client versions, to reduce the potential impact of a man-in-the-middle attack.

Correção

Identificadores relacionados

CVE-2004-2621

Produtos afetados

Nortel Contivity Vpn Client

Referências · 8

• http://secunia.com/advisories/12881 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17812 · Nota
• http://osvdb.org/11002 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2621 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2621 · Nota de Segurança
• http://securitytracker.com/id?1011846 · Nota
• http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?level=6&category=8&subcategory=6&subtype=&DocumentOID=276620&RenditionID=REND159588 · Nota
• http://securityfocus.com/bid/11495 · Nota