CVE-2002-1106: High severity Cisco VPN Client vulnerability
Published Oct 4, 2002
·Updated
Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator, which allows remote attackers to conduct man-in-the-middle attacks.
Affected Software
4 affected components
Cisco VPN Client=3.1
Cisco VPN Client=3.0
Cisco VPN Client=3.5.1
Cisco VPN Client=2.0
Event History
Oct 4, 2002
CVE Published
04:00 AM
Sep 1, 2004
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2002-1106?
CVE-2002-1106 is considered a high-severity vulnerability due to its potential for man-in-the-middle attacks.
2
How do I fix CVE-2002-1106?
To fix CVE-2002-1106, upgrade to Cisco VPN Client version 3.5.1C or later.
3
What versions of Cisco VPN Client are affected by CVE-2002-1106?
CVE-2002-1106 affects Cisco VPN Client versions 2.0, 3.0, 3.1, and all versions before 3.5.1C.
4
What type of attack can be executed due to CVE-2002-1106?
CVE-2002-1106 allows remote attackers to conduct man-in-the-middle attacks.
5
Is there a workaround for CVE-2002-1106 if I cannot upgrade?
There are no known workarounds for CVE-2002-1106, so upgrading is the recommended solution.