Executive Summary
| Summary | |
|---|---|
| Title | Cisco VPN 3000 Concentrator FTP Management Vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | cisco-sa-20060823-vpn3k | First vendor Publication | 2006-08-22 |
| Vendor | Cisco | Last vendor Modification | 2006-08-23 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The Cisco VPN 3000 series concentrators are affected by two vulnerabilities when file management via File Transfer Protocol (FTP) is enabled that could allow authenticated or unauthenticated attackers to execute certain FTP commands and delete files on the concentrator. |
Original Source
| Url : http://www.cisco.com/warp/public/707/cisco-sa-20060823-vpn3k.shtml |
CPE : Common Platform Enumeration
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 28139 | Cisco VPN 3000 Concentrator FTP Management Unauthorized Command Execution (CS... VPN 3000 Concentrator contains a flaw that may allow a malicious user to bypass certain security restrictions. The issue is triggered due to unspecified errors when using FTP as a management protocol and can be exploited to run the 'CWD', 'MKD', 'CDUP', 'RNFR', 'SIZE', and 'RMD' commands without being authenticated. It is possible that the flaw may allow deleting configuration files and certificates resulting in a loss of integrity. |
| 28138 | Cisco VPN 3000 Concentrator FTP Management Unauthorized Command Execution (CS... VPN 3000 Concentrator contains a flaw that may allow a malicious user to bypass certain security restrictions. The issue is triggered due to unspecified errors when using FTP as a management protocol and can be exploited to run the 'CWD', 'MKD', 'CDUP', 'RNFR', 'SIZE', and 'RMD' commands without being authenticated. It is possible that the flaw may allow deleting configuration files and certificates resulting in a loss of integrity. |
Alert History
| Date | Informations |
|---|---|
| 2015-10-30 00:21:36 |
|
| 2013-08-20 09:21:04 |
|
