Cisco Secure Desktop Software Update Bug Lets Remote Users Downgrade the Target User to an Older Version or Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1027190 |
|
SecurityTracker URL: http://securitytracker.com/id/1027190
|
|
CVE Reference:
CVE-2012-2495, CVE-2012-4655
(Links to External Site)
|
Updated: Sep 20 2012
|
Original Entry Date: Jun 20 2012
|
Impact:
Execution of arbitrary code via network, Modification of system information, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 3.0 - 3.6.6020
|
Description:
Two vulnerabilities were reported in Cisco Secure Desktop. A remote user can cause an older version of the software to be installed on the target user's system. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create specially crafted HTML that, when loaded by the target user, will cause the target user to download and install an older version of the client software [CVE-2012-2495].
Cisco has assigned Cisco Bug ID CSCtx74235 to this vulnerability.
gwslabs.com reported this vulnerability (via HP's Zero Day Initiative).
Cisco AnyConnect Secure Mobility Client is also affected by this vulnerability.
A remote user can create specially crafted HTML that, when loaded by the target user, will execute arbitrary code on the target user's system [CVE-2012-4655].
Cisco has assigned Cisco Bug IDs CSCtz76128 and CSCtz78204 to this vulnerability.
|
Impact:
A remote user can create HTML that, when loaded by the target user, will cause an older version of the software to be installed or execute arbitrary code on the target user's system .
|
Solution:
The vendor has issued a fix (3.6.6020).
The vendor's advisory is available at:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac
|
Vendor URL: tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 20 Jun 2012 20:35:37 +0000
Subject: Cisco Secure Desktop
|
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac
CVE-2012-2495
|
|
