5/7/2007 -- Cisco Systems Inc. last week alerted customers to a number of new vulnerabilities in its Adaptive Security Appliance (ASA) and PIX security appliances.

Under certain circumstances, Cisco conceded, an attacker could exploit the most serious of these flaws to bypass LDAP authentication mechanisms and gain access to network resources -- or to the appliance itself.

In a security advisory published on its Web site, Cisco acknowledged that its ASA and PIX appliances are vulnerable to two LDAP authentication bypass vulnerabilities along with a pair of denial-of-service (DoS) flaws. The networking giant released software updates to patch all four flaws.

The first of the LDAP vulnerabilities involves L2TP and IPsec. Devices which terminate L2TP IPsec tunnels and which are configured to use LDAP in tandem with either CHAP, MS-CHAPv1 or MS-CHAPv2 are vulnerable to an authentication bypass exploit, Cisco said. However, in cases where LDAP authentication is used along with PAP, devices are not vulnerable.

The second LDAP flaw involves a potential remote management and access exploit. ASA and PIX devices which use LDAP AAA servers to authenticate management sessions (via telnet, SSH and HTTP) may be vulnerable to an authentication bypass attack. There are a couple of caveats, of course: Admins must specifically configure a device so that it supports remote access management sessions, for starters, and such access is also typically limited to a pre-defined range of source IP addresses within the device's configuration.

In either case, Cisco acknowledged, an attacker who successfully exploits these vulnerabilities could gain access either to internal network or the device itself.

The DoS vulnerabilities take the form of a password expiration exploit and an SSL VPN exploit. The former flaw affects ASA and PIX devices that terminate VPN connections. If an administrator configures password expiry for the VPN tunnel group, Cisco warned, an attacker could potentially reload the device. To exploit this vulnerability for IPsec VPN connections, an attacker would have to know the correct group name and group password; for SSL VPN connections, on the other hand, he or she wouldn't need this information.

Finally, Cisco said ASAs using clientless SSL VPNs are vulnerable to potential DoS via their SSL VPN HTTP servers. In this case, too, an attacker could force the reloading of the device, Cisco indicated. --Stephen Swoyer