CVE-2001-1105

Cisco iCND 2.0 - Unauthenticated SSL Client Authentication Bypass via Cached Session ID

Title source: llm

Description

RSA BSAFE SSL-J 3.0, 3.0.1 and 3.1, as used in Cisco iCND 2.0, caches session IDs from failed login attempts, which could allow remote attackers to bypass SSL client authentication and gain access to sensitive data by logging in after an initial failure.

References (5)

Core 5

Core References

Various Sources x_refsource_confirm

http://www.rsasecurity.com/products/bsafe/bulletins/BSAFE_SSL-J_3.x.SecurityBulletin.html

Vendor Advisory vendor-advisory x_refsource_cisco

http://www.cisco.com/warp/public/707/SSL-J-pub.html

Patch, Vendor Advisory vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/3329

Patch, Vendor Advisory third-party-advisory government-resource x_refsource_ciac

http://www.ciac.org/ciac/bulletins/l-141.shtml

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/7112

Scores

EPSS 0.0004

EPSS Percentile 11.4%

Details

Status published

Products (4)

cisco/icdn 2.0

dell/bsafe_ssl-j 3.0

dell/bsafe_ssl-j 3.0.1

dell/bsafe_ssl-j 3.1

Published Sep 12, 2001

Tracked Since Feb 18, 2026