Cisco AnyConnect Secure Mobility Client VPN Downloader Arbitrary Code Execution Vulnerabilities

Bugtraq ID:	54107
Class:	Input Validation Error
CVE:	CVE-2012-2493 CVE-2012-2496
Remote:	Yes
Local:	No
Published:	Jun 20 2012 12:00AM
Updated:	Sep 11 2012 06:50PM
Credit:	gwslabs.com via Zero Day Initiative and Cisco
Vulnerable:	Cisco AnyConnect Secure Mobility Client 3.0.629 Cisco AnyConnect Secure Mobility Client 3.0 Cisco AnyConnect Secure Mobility Client 2.5.3046 Cisco AnyConnect Secure Mobility Client 2.5.3041 Cisco AnyConnect Secure Mobility Client 2.5
Not Vulnerable:

Cisco AnyConnect Secure Mobility Client VPN Downloader Arbitrary Code Execution Vulnerabilities

Cisco AnyConnect Secure Mobility Client is prone to multiple vulnerabilities that allow attackers to run an arbitrary executable. This issue affects the VPN Downloader component.

An attacker can exploit this issue by using social engineering techniques to coerce unsuspecting users to download and execute arbitrary applications.

Successful exploits will allow an attacker to execute arbitrary code in the context of the user running the web browser. Failed exploit attempts will likely result in a denial-of-service condition.

These issues are tracked by Cisco Bug IDs CSCtw47523 and CSCty45925.

Cisco AnyConnect Secure Mobility Client VPN Downloader Arbitrary Code Execution Vulnerabilities

Attackers can exploit these issues by enticing an unsuspecting user to visit a specially crafted website.

Cisco AnyConnect Secure Mobility Client VPN Downloader Arbitrary Code Execution Vulnerabilities

Solution:
The vendor has released an advisory and fixes. Please see the references for details.

Cisco AnyConnect Secure Mobility Client VPN Downloader Arbitrary Code Execution Vulnerabilities

References:

• Cisco Homepage (Cisco)