Cisco AnyConnect Secure Mobility Client Heap Overflow Local Privilege Escalation Vulnerability

Bugtraq ID:	59036
Class:	Boundary Condition Error
CVE:	CVE-2013-1173
Remote:	No
Local:	Yes
Published:	Apr 10 2013 12:00AM
Updated:	Apr 10 2013 12:00AM
Credit:	Cisco
Vulnerable:	Cisco AnyConnect Secure Mobility Client 3.2 Cisco AnyConnect Secure Mobility Client 3.1.495 Cisco AnyConnect Secure Mobility Client 3.1 Cisco AnyConnect Secure Mobility Client 3.0.8066 Cisco AnyConnect Secure Mobility Client 3.0.8057 Cisco AnyConnect Secure Mobility Client 3.0.7059 Cisco AnyConnect Secure Mobility Client 3.0.5080 Cisco AnyConnect Secure Mobility Client 3.0.5075 Cisco AnyConnect Secure Mobility Client 3.0.4235 Cisco AnyConnect Secure Mobility Client 3.0.3054 Cisco AnyConnect Secure Mobility Client 3.0.3050 Cisco AnyConnect Secure Mobility Client 3.0.2052 Cisco AnyConnect Secure Mobility Client 3.0.1047 Cisco AnyConnect Secure Mobility Client 3.0.629 Cisco AnyConnect Secure Mobility Client 2.5.6005 Cisco AnyConnect Secure Mobility Client 2.5.5131 Cisco AnyConnect Secure Mobility Client 2.5.5130 Cisco AnyConnect Secure Mobility Client 2.5.5125 Cisco AnyConnect Secure Mobility Client 2.5.5118 Cisco AnyConnect Secure Mobility Client 2.5.5116 Cisco AnyConnect Secure Mobility Client 2.5.5112 Cisco AnyConnect Secure Mobility Client 2.5.3055 Cisco AnyConnect Secure Mobility Client 2.5.3054 Cisco AnyConnect Secure Mobility Client 2.5.3051 Cisco AnyConnect Secure Mobility Client 2.5.2019 Cisco AnyConnect Secure Mobility Client 2.5.2018 Cisco AnyConnect Secure Mobility Client 2.5.2017 Cisco AnyConnect Secure Mobility Client 2.5.2014 Cisco AnyConnect Secure Mobility Client 2.5.2011 Cisco AnyConnect Secure Mobility Client 2.5.2010 Cisco AnyConnect Secure Mobility Client 2.5.2006 Cisco AnyConnect Secure Mobility Client 2.5.2001 Cisco AnyConnect Secure Mobility Client 2.5.1025 Cisco AnyConnect Secure Mobility Client 2.5.217 Cisco AnyConnect Secure Mobility Client 2.4.7073 Cisco AnyConnect Secure Mobility Client 2.4.7030 Cisco AnyConnect Secure Mobility Client 2.4.5004 Cisco AnyConnect Secure Mobility Client 2.4.4014 Cisco AnyConnect Secure Mobility Client 2.4.4004 Cisco AnyConnect Secure Mobility Client 2.4.1012 Cisco AnyConnect Secure Mobility Client 2.4.202 Cisco AnyConnect Secure Mobility Client 2.3.2016 Cisco AnyConnect Secure Mobility Client 2.2.140 Cisco AnyConnect Secure Mobility Client 2.2.136 Cisco AnyConnect Secure Mobility Client 2.2.133 Cisco AnyConnect Secure Mobility Client 2.2.128 Cisco AnyConnect Secure Mobility Client 2.5.3046 Cisco AnyConnect Secure Mobility Client 2.5.3041 Cisco AnyConnect Secure Mobility Client 2.5 Cisco AnyConnect Secure Mobility Client 2.4 Cisco AnyConnect Secure Mobility Client 2.3.254 Cisco AnyConnect Secure Mobility Client 2.3.185 Cisco AnyConnect Secure Mobility Client 2.3 Cisco AnyConnect Secure Mobility Client 2.2 Cisco AnyConnect Secure Mobility Client 2.1 Cisco AnyConnect Secure Mobility Client 2
Not Vulnerable:

Cisco AnyConnect Secure Mobility Client Heap Overflow Local Privilege Escalation Vulnerability

Cisco AnyConnect Secure Mobility Client is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to gain elevated SYSTEM privileges. Successful exploits will result in the complete compromise of affected computers.

This issue is being tracked by Cisco Bug ID CSCud14143.

Cisco AnyConnect Secure Mobility Client Heap Overflow Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.