CVE-2001-0427: Input Validation

Published Jun 18, 2001

Updated

Cisco VPN 3000 series concentrators before 2.5.2(F) allow remote attackers to cause a denial of service via a flood of invalid login requests to (1) the SSL service, or (2) the telnet service, which do not properly disconnect the user after several failed login attempts.

Affected Software

6 affected components

Cisco Vpn 3015 Concentrator

Cisco Vpn 3060 Concentrator

Cisco VPN 3000 Concentrator

Cisco Vpn 3005 Concentrator

Cisco Vpn 3030 Concentator

Cisco Vpn 3080 Concentrator

Remediation

Patch Available

http://www.cisco.com/warp/public/707/vpn3k-telnet-vuln-pub.shtml

Event History

Jun 18, 2001

CVE Published

04:00 AM

Sep 18, 2001

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2001-0427?

CVE-2001-0427 is considered a denial of service vulnerability that can disrupt availability by allowing remote attackers to flood the system with invalid login requests.

How do I fix CVE-2001-0427?

To mitigate CVE-2001-0427, it is recommended to upgrade to Cisco VPN 3000 series concentrators firmware version 2.5.2(F) or later.

What products are affected by CVE-2001-0427?

CVE-2001-0427 affects several models of Cisco VPN 3000 series concentrators including the 3015, 3060, 3000, 3005, 3030, and 3080.

Can CVE-2001-0427 be exploited internally?

Yes, CVE-2001-0427 can be exploited by internal attackers if they can send a flood of invalid login requests to the vulnerable services.

Is CVE-2001-0427 a patchable vulnerability?

Yes, CVE-2001-0427 can be mitigated by applying the recommended firmware updates provided by Cisco.