Cisco AnyConnect Secure Mobility Client Software Update Bugs Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1027189 |
|
SecurityTracker URL: http://securitytracker.com/id/1027189
|
|
CVE Reference:
CVE-2012-2493, CVE-2012-2494, CVE-2012-2495, CVE-2012-2496
(Links to External Site)
|
Updated: Sep 11 2012
|
Original Entry Date: Jun 20 2012
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 2.5.x, 3.0.x
|
Description:
Several vulnerabilities were reported in Cisco AnyConnect Secure Mobility Client. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted HTML that, when loaded by the target user, will execute arbitrary code on the target system. The code will run with the privileges of the target user.
An input validation flaw allows remote code execution [CVE-2012-2493]. Cisco has assigned Cisco Bug ID CSCtw47523 to this vulnerability.
A remote user can cause the target user to download and install an older version of the client software [CVE-2012-2494]. Cisco has assigned Cisco Bug ID CSCtw48681 to this vulnerability.
A remote user can cause the target user to download and install an older version of the client software [CVE-2012-2495]. Cisco has assigned Cisco Bug ID CSCtx74235 to this vulnerability. Cisco Secure Desktop is also affected by this vulnerability.
A remote user can trigger a flaw in the 64-bit Java applet to execute arbitrary code [CVE-2012-2496]. Cisco has assigned Cisco Bug ID CSCty45925 to this vulnerability.
The CLSIDs of the vulnerable ActiveX controls are:
55963676-2F5E-4BAF-AC28-CF26AA587566
CC679CB8-DC4B-458B-B817-D447B3B6AC31
705EC6D4-B138-4079-A307-EF13E4889A82
F8FC1530-0608-11DF-2008-0800200C9A66
E34F52FE-7769-46ce-8F8B-5E8ABAD2E9FC
The first input validation and version downgrade vulnerabilities were reported by gwslabs.com via HP's Zero Day Initiative.
|
Impact:
A remote user can create HTML that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution:
The vendor has issued a fix (2.5 MR6, 3.0 MR8).
[Editor's note: On September 11, 2012, Microsoft issued an update to set kill bits for this vulnerability. The Microsoft advisory is available at: http://technet.microsoft.com/en-us/security/advisory/2736233]
The vendor's advisory is available at:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac
|
Vendor URL: tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Linux (Any), UNIX (OS X), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 20 Jun 2012 12:25:18 -0400
Subject: Cisco Security Advisory: Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
Advisory ID: cisco-sa-20120620-ac
Revision 1.0
For Public Release 2012 June 20 16:00 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
The Cisco AnyConnect Secure Mobility Client is affected by the
following vulnerabilities:
Cisco AnyConnect Secure Mobility Client VPN Downloader Arbitrary Code
Execution Vulnerability
Cisco AnyConnect Secure Mobility Client VPN Downloader Software
Downgrade Vulnerability
Cisco AnyConnect Secure Mobility Client and Cisco Secure Desktop
HostScan Downloader Software Downgrade Vulnerability
Cisco AnyConnect Secure Mobility Client 64-bit Java VPN Downloader
Arbitrary Code Execution Vulnerability
Cisco has released free software updates that address these
vulnerabilities. Workarounds that mitigate these vulnerabilities are
available.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iF4EAREIAAYFAk/hxbIACgkQQXnnBKKRMNBg/gD/UfO5FCOVvzRdsSugHPrSrEFT
Rd4Q0AvReBoziS3fIfAA/isBKtBmeC+mseVPOPqAw8XlCaPCqBF58UOvRIx7mmaV
=4OQe
-----END PGP SIGNATURE-----
|
|
