vulnerability alert CVE-2010-4354
Cisco ASA, PIX, VPN: enumeration of groupnames
Synthesis of the vulnerability
When a PSK authentication is used, an attacker can guess valid identifiers with a brute force attack.Impacted products:
ASA, Cisco VPN Concentrator.
112227, BID-45161, cisco-sr-20101124-vpn-grpname, CSCtj96108, CVE-2010-4354, NGS00014, VIGILANCE-VUL-10166.
Description of the vulnerability
The VPN PSK (Pre-Shared Key) authentication uses an identifier/password. The identifier is called the "groupname". The password is called the pre-shared key.
When a VPN client authenticates with a bad identifier, Cisco products do not answer. When the identifier is valid, an answer packet is sent back. An attacker can thus guess if an identifier is valid.
Impacted products are:
- Cisco ASA 5500
- Cisco PIX 500
- Cisco VPN 3000 Series Concentrators
When a PSK authentication is used, an attacker can therefore guess valid identifiers with a brute force attack.Complete Vigil@nce bulletin....
Share this bulletin
Computer vulnerabilities tracking service
Vigil@nce provides network vulnerability announces
. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications. Each administrator can customize the list of products for which he wants to receive vulnerability alerts. The Vigil@nce computer vulnerability tracking service alerts your teams of vulnerabilities or threats impacting your information system.