9.3

CVE-2012-2493

The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 on Windows, and 2.x before 2.5 MR6 and 3.x before 3.0 MR8 on Mac OS X and Linux, does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components, aka Bug ID CSCtw47523.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Anyconnect Secure Mobility Client Version 2.3.2016
   Microsoft ≫ Windows
Cisco ≫ Anyconnect Secure Mobility Client Version 2.4.0202
   Microsoft ≫ Windows
Cisco ≫ Anyconnect Secure Mobility Client Version 2.4.1012
   Microsoft ≫ Windows
Cisco ≫ Anyconnect Secure Mobility Client Version 2.2.128
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.2.133
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.2.136
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.2.140
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.3.185
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.3.254
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.3.2016
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.4.0202
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Cisco ≫ Anyconnect Secure Mobility Client Version 2.4.1012
   Apple ≫ macOS X
   Linux ≫ Linux Kernel
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.89% 0.889
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac
Vendor Advisory