Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security VulnWatch
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [VulnWatch] Cisco Security Advisory: Cisco VPN 3000 Concentrator Vul

from [Mike Iglesias] Network Security [Permanent Link]
Subject: Re: [VulnWatch] Cisco Security Advisory: Cisco VPN 3000 Concentrator Vulnerable to Crafted HTTP Attack
Date: Tue, 31 Jan 2006 23:15:35 -0800 
Finally, the advisory states that upgrading to firmware version 4.7.2B is
sufficient to defend against this exploit.  This is not the case.  The
original tests WERE performed against VPN 3000 appliances running 4.7.1
but subsequent tests show that 4.7.2B is also susceptible to this
exploit.  The only way to resolve this issue is to block tcp/80 via ACL or
by disabling it on the WebVPN.


FYI: I asked Cisco which version this bug was fixed in, and they said
that 4.7.2(C) has the fix.


Mike Iglesias                          Email:       iglesias@uci.edu
University of California, Irvine       phone:       949-824-6926
Network & Academic Computing Services  FAX:         949-824-2069
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • Re: [VulnWatch] Cisco Security Advisory: Cisco VPN 3000 Concentrator Vulnerable to Crafted HTTP Attack, Mike Iglesias <=
Next by Date:  [Full-disclosure] iDefense Security Advisory 02.01.06: Winamp m3u/pls .WMA Extension Buffer Overflow Vulnerability, labs-no-reply@idefense.com
Next by Thread:  [Full-disclosure] iDefense Security Advisory 02.01.06: Winamp m3u/pls .WMA Extension Buffer Overflow Vulnerability, labs-no-reply@idefense.com
Indexes:  [Date] [Thread] [Top] [All Lists]