Vulnerabilities > CVE-2006-4313 - Unspecified vulnerability in Cisco VPN 3000 Concentrator Series Software
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
PARTIAL Availability impact
NONE Summary
Multiple unspecified vulnerabilities in Cisco VPN 3000 series concentrators before 4.1, 4.1.x up to 4.1(7)L, and 4.7.x up to 4.7(2)F allow attackers to execute the (1) CWD, (2) MKD, (3) CDUP, (4) RNFR, (5) SIZE, and (6) RMD FTP commands to modify files or create and delete directories via unknown vectors.
Vulnerable Configurations
Metasploit
| description | This module tests for a logic vulnerability in the Cisco VPN Concentrator 3000 series. It is possible to execute some FTP statements without authentication (CWD, RNFR, MKD, RMD, SIZE, CDUP). It also appears to have some memory leak bugs when working with CWD commands. This module simply creates an arbitrary directory, verifies that the directory has been created, then deletes it and verifies deletion to confirm the bug. |
| id | MSF:AUXILIARY/ADMIN/CISCO/VPN_3000_FTP_BYPASS |
| last seen | 2020-06-12 |
| modified | 2017-11-08 |
| published | 2009-07-06 |
| references | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4313 |
| reporter | Rapid7 |
| source | https://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/admin/cisco/vpn_3000_ftp_bypass.rb |
| title | Cisco VPN Concentrator 3000 FTP Unauthorized Administrative Access |
References
- http://secunia.com/advisories/21617
- http://securitytracker.com/id?1016737
- http://www.cisco.com/warp/public/707/cisco-sa-20060823-vpn3k.shtml
- http://www.osvdb.org/28138
- http://www.osvdb.org/28139
- http://www.securityfocus.com/bid/19680
- http://www.vupen.com/english/advisories/2006/3368
- https://exchange.xforce.ibmcloud.com/vulnerabilities/28539