US government says virtual private networks vulnerable

The US government has identified flaws in equipment from four companies, including Cisco Systems, that hackers can exploit to break into corporate computer networks.

The Department of Homeland Security's US Computer Emergency Readiness Team, US-CERT, said on its website on Wednesday that the warning applies to certain networking products from Cisco, Juniper Networks, SonicWall and SafeNet.

The flaw applies to equipment with technology known as SSL VPN that companies use to set up secure communications systems for safely accessing internal computer systems over the Internet.

It affects VPN systems run directly through a web browser, rather than through software installed on a user's PC, which is more widely used.

Hackers who exploit the vulnerability could gain broad access to corporate networks, then steal confidential data, install malicious software or turn PCs into spam servers.

US-CERT's posting said the manufacturers have yet to develop a remedy for the problem, which government officials brought to their attention on 24 September.

In the meantime, US-CERT researchers have developed three "workarounds" that they said minimise, but do not eliminate, the risk of an attack.

Barry Greene, head of Juniper's security response team, said his company has known of the vulnerability for several years and has urged customers to run the systems with workarounds in place.

"Our customers who follow the best common practice significantly reduce the risk - to the point where they don't need to worry about it," he said.

SafeNet spokeswoman Donna St. Germain said her company had already devised a way to completely eliminate the risk and advised customers how to configure their equipment to do so.

The government agency said that SSL VPN products from other companies could potentially be at risk, though it has not tested them.

A spokesperson for Cisco said he could not immediately comment on the matter. SonicWall did not respond to a request for comment.