Cisco Secure Desktop CVE-2012-4655 Arbitrary Code Execution Vulnerability

Bugtraq ID:	55606
Class:	Input Validation Error
CVE:	CVE-2012-4655
Remote:	Yes
Local:	No
Published:	Sep 19 2012 12:00AM
Updated:	Sep 19 2012 12:00AM
Credit:	Cisco
Vulnerable:	Cisco Secure Desktop 3.5.1077 Cisco Secure Desktop 3.5.841 Cisco Secure Desktop 3.4.2048 Cisco Secure Desktop 3.2 Cisco Secure Desktop 3.1.1.45 Cisco AnyConnect Secure Mobility Client 3.0.629 Cisco AnyConnect Secure Mobility Client 3.0 Cisco AnyConnect Secure Mobility Client 2.5.3046 Cisco AnyConnect Secure Mobility Client 2.5.3041 Cisco AnyConnect Secure Mobility Client 2.5
Not Vulnerable:

Cisco Secure Desktop CVE-2012-4655 Arbitrary Code Execution Vulnerability

Cisco Secure Desktop is prone to a vulnerability that allow attackers to run an arbitrary executable.

An attacker can exploit this issue by using social engineering techniques to coerce unsuspecting users to download and execute arbitrary applications.

Successful exploits will allow an attacker to execute arbitrary code in the context of the user running the web browser. Failed exploit attempts will likely result in a denial-of-service condition.

This issue is tracked by Cisco Bug IDs CSCtz76128 and CSCtz78204.

Cisco Secure Desktop CVE-2012-4655 Arbitrary Code Execution Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to visit a specially crafted website.

Cisco Secure Desktop CVE-2012-4655 Arbitrary Code Execution Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for details.

Cisco Secure Desktop CVE-2012-4655 Arbitrary Code Execution Vulnerability

References:

• Cisco Homepage (Cisco)