Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability

Bugtraq ID:	48081
Class:	Unknown
CVE:	CVE-2011-2039 CVE-2011-2040
Remote:	Yes
Local:	No
Published:	Jun 01 2011 12:00AM
Updated:	Jul 07 2011 05:10PM
Credit:	Elazar Broad working with iDefense Labs
Vulnerable:	Cisco AnyConnect VPN Client 2.4.202 Cisco AnyConnect Secure Mobility Client 3.0 Cisco AnyConnect Secure Mobility Client 2.5 Cisco AnyConnect Secure Mobility Client 2.3
Not Vulnerable:	Cisco AnyConnect Secure Mobility Client 3.0.629 Cisco AnyConnect Secure Mobility Client 2.5.3046 Cisco AnyConnect Secure Mobility Client 2.3.185

Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability

Cisco AnyConnect Secure Mobility Client is prone to a vulnerability that allows attackers to run an arbitrary executable.

An attacker can exploit this issue by using social engineering techniques to coerce unsuspecting users to download and execute arbitrary applications.

This issue is tracked by Cisco Bug IDs CSCsy00904 and CSCsy05934.

Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to visit a specially crafted website.

The following exploit code is available:

• /data/vulnerabilities/exploits/48081.rb

Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for details.

Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability

References:

• Cisco Homepage (Cisco)
  
• Cisco AnyConnect VPN Client Arbitrary Program Execution Vulnerability (iDefense Labs)
  
• Cisco AnyConnect VPN Client Arbitrary Program Execution Vulnerability (iDefense Labs)
  
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco AnyConnect Secure Mob (Cisco)
  
• VU#490097 Cisco AnyConnect SSL VPN arbitrary code execution (US-CERT)