CVE-2002-1106

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.1C, does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator, which allows remote attackers to conduct man-in-the-middle attacks.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.cisco.com/warp/public/707/vpnclient-multiple2-vuln-pub.shtmlVendor Advisory
http://www.securityfocus.com/bid/5652Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/10045
http://www.cisco.com/warp/public/707/vpnclient-multiple2-vuln-pub.shtmlVendor Advisory
http://www.securityfocus.com/bid/5652Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/10045

Timeline

Published: Oct 4, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-11077.5Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.2B, does not generate sufficiently random numbers, which may m CVE-2002-11085.0Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.6(Rel), when configured with all tunnel mode, can be forced into CVE-2002-11092.1securetar, as used in AMaViS shell script 0.2.1 and earlier, allows users to cause a denial of service (CPU consumption) via a malformed TAR CVE-2002-111010.0Multiple SQL injection vulnerabilities in Mantis 0.17.2 and earlier, when running without magic_quotes_gpc enabled, allows remote attackers CVE-2002-11115.0print_all_bug_page.php in Mantis 0.17.3 and earlier does not verify the limit_reporters option, which allows remote attackers to view bug su CVE-2002-11125.0Mantis before 0.17.4 allows remote attackers to list project bugs without authentication by modifying the cookie that is used by the "View B CVE-2002-11137.5summary_graph_functions.php in Mantis 0.17.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the g_jpgraph_pa CVE-2002-11147.5config_inc2.php in Mantis before 0.17.4 allows remote attackers to execute arbitrary code or read arbitrary files via the parameters (1) g_b CVE-2002-11155.0Mantis 0.17.4a and earlier allows remote attackers to view private bugs by modifying the f_id bug ID parameter to (1) bug_update_advanced_pa CVE-2002-11167.5The "View Bugs" page (view_all_bug_page.php) in Mantis 0.17.4a and earlier includes summaries of private bugs for users that do not have acc CVE-2002-11175.0Veritas Backup Exec 8.5 and earlier requires that the "RestrictAnonymous" registry key for Microsoft Exchange 2000 must be set to 0, which e CVE-2002-11185.0TNS Listener in Oracle Net Services for Oracle 9i 9.2.x and 9.0.x, and Oracle 8i 8.1.x, allows remote attackers to cause a denial of service