QID 375944

Date Published: 2021-10-07

QID 375944: Cisco AnyConnect Secure Mobility Client for Linux and Mac OS with Virtual Private Network (VPN) Posture (HostScan) Module Shared Library Hijacking Vulnerability (cisco-sa-anyconnect-lib-hija-cAFB7x4q)

A vulnerability in the shared library loading mechanism of Cisco AnyConnect Secure Mobility Client for Linux and Mac OS
could allow an authenticated, local attacker to perform a shared library hijacking attack on an affected device if the
VPN Posture (HostScan) Module is installed on the AnyConnect client.

Affected Products
Devices that are running a vulnerable release of Cisco AnyConnect Secure Mobility Client for
Linux and Mac OS if the VPN Posture (HostScan) Module is installed.
Versions prior to 4.10.03104
Note: Potential detection as cannot confirm on whether VPN Posture (HostScan) module is installed.

QID Detection Logic (Authenticated):
This checks for vulnerable version of AnyConnect Mobility Client.

A successful exploit could allow the attacker to execute arbitrary code on the affected device with root privileges.
To exploit this vulnerability, the attacker must have a valid account on the system.

  • CVSS V3 rated as High - 7 severity.
  • CVSS V2 rated as High - 6.9 severity.
    • Solution

    Customers are advised to refer to cisco-sa-anyconnect-lib-hija-cAFB7x4q for more information.

    Vendor References

    CVEs related to QID 375944

    CVE-2021-34788 |
    Software Advisories
    Advisory ID Software Component Link
    cisco-sa-anyconnect-lib-hija-cAFB7x4q URL Logo tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-lib-hija-cAFB7x4q
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].