CVE-2002-1108: Medium severity Cisco VPN Client vulnerability
Published Oct 4, 2002
·Updated
Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.6(Rel), when configured with all tunnel mode, can be forced into acknowledging a TCP packet from outside the tunnel.
Affected Software
9 affected components
Cisco VPN Client=3.5.1c
Cisco VPN Client=3.1
Cisco VPN Client=3.5.1
Cisco VPN Client=3.5.1
Cisco VPN Client=3.0
Cisco VPN Client=3.5.1
Cisco VPN Client=2.0
Cisco VPN Client=3.0.5
Cisco VPN Client=3.5.1
Event History
Oct 4, 2002
CVE Published
04:00 AM
Sep 1, 2004
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2002-1108?
CVE-2002-1108 is classified as a medium severity vulnerability.
2
How do I fix CVE-2002-1108?
To mitigate CVE-2002-1108, upgrade to a later version of Cisco VPN Client that contains the necessary fixes.
3
Which Cisco VPN Client versions are affected by CVE-2002-1108?
CVE-2002-1108 affects Cisco VPN Client versions 2.x.x and 3.x versions prior to 3.6(Rel).
4
What is the impact of CVE-2002-1108 on Cisco VPN Client users?
Users of Cisco VPN Client may be vulnerable to receiving malicious TCP packets from outside the tunnel.
5
Is CVE-2002-1108 applicable to non-Windows operating systems?
Yes, CVE-2002-1108 affects Cisco VPN Client versions on multiple operating systems including Windows, Mac OS X, and Linux.