PT-2005-2968 · Cisco · Cisco Vpn 3000 Concentrator

Published 2005-06-20 · Updated 2018-10-30 · CVE-2005-2025

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco VPN 3000 Concentrator versions prior to 4.1.7.F

Description The issue allows remote attackers to determine valid groupnames by sending an IKE Aggressive Mode packet with the groupname in the ID field. This generates a response if the groupname is valid, but does not generate a response for an invalid groupname.

Recommendations For versions prior to 4.1.7.F, update to version 4.1.7.F or later to resolve the issue. As a temporary workaround, consider restricting access to the IKE Aggressive Mode to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-2025

Affected Products

Cisco Vpn 3000 Concentrator

References · 4

• 🔥 http://nta-monitor.com/news/vpn-flaws/cisco/VPN-Concentrator/index.htm · Exploit
• http://securityfocus.com/bid/13992 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2025 · Security Note
• http://vupen.com/english/advisories/2005/0822 · Note