SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   Cisco Secure Desktop Vendors:   Cisco
Cisco Secure Desktop Software Update Bug Lets Remote Users Downgrade the Target User to an Older Version or Execute Arbitrary Code
SecurityTracker Alert ID:  1027190
SecurityTracker URL:  http://securitytracker.com/id/1027190
CVE Reference:   CVE-2012-2495, CVE-2012-4655   (Links to External Site)
Updated:  Sep 20 2012
Original Entry Date:  Jun 20 2012
Impact:   Execution of arbitrary code via network, Modification of system information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.0 - 3.6.6020
Description:   Two vulnerabilities were reported in Cisco Secure Desktop. A remote user can cause an older version of the software to be installed on the target user's system. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create specially crafted HTML that, when loaded by the target user, will cause the target user to download and install an older version of the client software [CVE-2012-2495].

Cisco has assigned Cisco Bug ID CSCtx74235 to this vulnerability.

gwslabs.com reported this vulnerability (via HP's Zero Day Initiative).

Cisco AnyConnect Secure Mobility Client is also affected by this vulnerability.

A remote user can create specially crafted HTML that, when loaded by the target user, will execute arbitrary code on the target user's system [CVE-2012-4655].

Cisco has assigned Cisco Bug IDs CSCtz76128 and CSCtz78204 to this vulnerability.

Impact:   A remote user can create HTML that, when loaded by the target user, will cause an older version of the software to be installed or execute arbitrary code on the target user's system .
Solution:   The vendor has issued a fix (3.6.6020).

The vendor's advisory is available at:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac

Vendor URL:  tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac (Links to External Site)
Cause:   Input validation error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC