CVE-2004-2621: Race Condition
Nortel Contivity VPN Client 2.1.7, 3.00, 3.01, 4.91, and 5.01, when opening a VPN tunnel, does not check the gateway certificate until after a dialog box has been displayed to the user, which creates a race condition that allows remote attackers to perform a man-in-the-middle (MITM) attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2004-2621?
CVE-2004-2621 has a moderate severity level due to the potential for man-in-the-middle attacks.
How do I fix CVE-2004-2621?
To mitigate CVE-2004-2621, update the Nortel Contivity VPN Client to a patched version that addresses the certificate check issue.
What platforms are affected by CVE-2004-2621?
CVE-2004-2621 affects versions 2.1.7, 3.00, 3.01, 4.91, and 5.01 of the Nortel Contivity VPN Client.
What type of attack is facilitated by CVE-2004-2621?
CVE-2004-2621 facilitates a man-in-the-middle (MITM) attack due to the improper timing of certificate validation.
Is CVE-2004-2621 still a concern for current VPN usage?
While CVE-2004-2621 is an older vulnerability, it remains a concern for users running affected versions of the Nortel Contivity VPN Client.