9.3

CVE-2011-2040

The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.5.3041, and 3.0.x before 3.0.629, on Linux and Mac OS X downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a Java applet, aka Bug ID CSCsy05934.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Anyconnect Secure Mobility Client Version <= 2.5.2019
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.2.128
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.2.133
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.2.136
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.2.140
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.3.185
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.3.254
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.3.2016
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.4.0202
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.4.1012
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.5.1025
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.5.2001
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.5.2006
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.5.2010
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.5.2011
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.5.2014
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.5.2017
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.5.2018
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 10.68% 0.952
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.cisco.com/en/US/products/products_security_advisory09186a0080b80123.shtml
Vendor Advisory
http://www.kb.cert.org/vuls/id/490097
US Government Resource
http://www.securitytracker.com/id?1025591
https://exchange.xforce.ibmcloud.com/vulnerabilities/67739
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=910