Cisco AnyConnect Secure Mobility Client CVE-2017-6638 Local Privilege Escalation Vulnerability
BID:98938
Info
Cisco AnyConnect Secure Mobility Client CVE-2017-6638 Local Privilege Escalation Vulnerability
| Bugtraq ID: | 98938 |
| Class: | Design Error |
| CVE: |
CVE-2017-6638 |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 07 2017 12:00AM |
| Updated: | Jun 27 2017 02:04PM |
| Credit: | Felix Wilhelm. |
| Vulnerable: |
Cisco AnyConnect Secure Mobility Client 4.4.1054 Cisco AnyConnect Secure Mobility Client 4.4.243 Cisco AnyConnect Secure Mobility Client 4.3.5017 Cisco AnyConnect Secure Mobility Client 4.3.4027 Cisco AnyConnect Secure Mobility Client 4.3.3086 Cisco AnyConnect Secure Mobility Client 4.3.2039 Cisco AnyConnect Secure Mobility Client 4.3.1095 Cisco AnyConnect Secure Mobility Client 4.1 Cisco AnyConnect Secure Mobility Client 4.0.51 Cisco AnyConnect Secure Mobility Client 4.0.48 Cisco AnyConnect Secure Mobility Client 4.0 Cisco AnyConnect Secure Mobility Client 3.1.14018 Cisco AnyConnect Secure Mobility Client 2.5.5131 Cisco AnyConnect Secure Mobility Client 2.5.5130 Cisco AnyConnect Secure Mobility Client 2.5.5125 Cisco AnyConnect Secure Mobility Client 2.5.5118 Cisco AnyConnect Secure Mobility Client 2.5.5116 Cisco AnyConnect Secure Mobility Client 2.5.5112 Cisco AnyConnect Secure Mobility Client 2.5.3055 Cisco AnyConnect Secure Mobility Client 2.5.3054 Cisco AnyConnect Secure Mobility Client 2.5.3051 Cisco AnyConnect Secure Mobility Client 2.5.2019 Cisco AnyConnect Secure Mobility Client 2.5.2018 Cisco AnyConnect Secure Mobility Client 2.5.2017 Cisco AnyConnect Secure Mobility Client 2.5.2014 Cisco AnyConnect Secure Mobility Client 2.5.2011 Cisco AnyConnect Secure Mobility Client 2.5.2010 Cisco AnyConnect Secure Mobility Client 2.5.2006 Cisco AnyConnect Secure Mobility Client 2.5.2001 Cisco AnyConnect Secure Mobility Client 2.5.1025 Cisco AnyConnect Secure Mobility Client 2.5.217 Cisco AnyConnect Secure Mobility Client 2.4.7073 Cisco AnyConnect Secure Mobility Client 2.4.7030 Cisco AnyConnect Secure Mobility Client 2.4.5004 Cisco AnyConnect Secure Mobility Client 2.4.4014 Cisco AnyConnect Secure Mobility Client 2.4.4004 Cisco AnyConnect Secure Mobility Client 2.4.1012 Cisco AnyConnect Secure Mobility Client 2.4.202 Cisco AnyConnect Secure Mobility Client 2.3.2016 Cisco AnyConnect Secure Mobility Client 2.3.1003 Cisco AnyConnect Secure Mobility Client 2.3.254 Cisco AnyConnect Secure Mobility Client 2.3.185 Cisco AnyConnect Secure Mobility Client 2.2.140 Cisco AnyConnect Secure Mobility Client 2.2.140 Cisco AnyConnect Secure Mobility Client 2.2.136 Cisco AnyConnect Secure Mobility Client 2.2.136 Cisco AnyConnect Secure Mobility Client 2.2.133 Cisco AnyConnect Secure Mobility Client 2.2.133 Cisco AnyConnect Secure Mobility Client 2.2.128 Cisco AnyConnect Secure Mobility Client 2.1.148 Cisco AnyConnect Secure Mobility Client 2.0.343 Cisco AnyConnect Secure Mobility Client 4.4(243) Cisco AnyConnect Secure Mobility Client 4.4(1009) Cisco AnyConnect Secure Mobility Client 4.3(754) Cisco AnyConnect Secure Mobility Client 4.3(5017) Cisco AnyConnect Secure Mobility Client 4.3 Cisco AnyConnect Secure Mobility Client 4.2 Cisco AnyConnect Secure Mobility Client 4.1 (8) Cisco AnyConnect Secure Mobility Client 4.0(61) Cisco AnyConnect Secure Mobility Client 4.0(2049) Cisco AnyConnect Secure Mobility Client 4.0 (64) Cisco AnyConnect Secure Mobility Client 4.0 (48) Cisco AnyConnect Secure Mobility Client 4.0 (2049) Cisco AnyConnect Secure Mobility Client 4.0 Cisco AnyConnect Secure Mobility Client 2.5.3046 Cisco AnyConnect Secure Mobility Client 2.5.3041 Cisco AnyConnect Secure Mobility Client 2.4 Cisco AnyConnect Secure Mobility Client 2.3.254 Cisco AnyConnect Secure Mobility Client 2.3.185 Cisco AnyConnect Secure Mobility Client 2.3 Cisco AnyConnect Secure Mobility Client 2.2 Cisco AnyConnect Secure Mobility Client 2.1 |
| Not Vulnerable: |
Cisco AnyConnect Secure Mobility Client 4.4.2034 |
Discussion
Cisco AnyConnect Secure Mobility Client CVE-2017-6638 Local Privilege Escalation Vulnerability
Cisco AnyConnect Secure Mobility Client is prone to a local privilege-escalation vulnerability.
A local attacker may exploit this issue to execute arbitrary commands with elevated SYSTEM privileges.
This issue is being tracked by Cisco Bug ID CSCvc97928.
Versions prior to Cisco AnyConnect Secure Mobility Client for Windows software 4.4.02034 are vulnerable.
Cisco AnyConnect Secure Mobility Client is prone to a local privilege-escalation vulnerability.
A local attacker may exploit this issue to execute arbitrary commands with elevated SYSTEM privileges.
This issue is being tracked by Cisco Bug ID CSCvc97928.
Versions prior to Cisco AnyConnect Secure Mobility Client for Windows software 4.4.02034 are vulnerable.
Exploit / POC
Cisco AnyConnect Secure Mobility Client CVE-2017-6638 Local Privilege Escalation Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Cisco AnyConnect Secure Mobility Client CVE-2017-6638 Local Privilege Escalation Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Cisco AnyConnect Secure Mobility Client CVE-2017-6638 Local Privilege Escalation Vulnerability
References:
References: