full-disclosure - Re: ZDI-12-149 : Cisco AnyConnect VPN Client Verification Bypass Remote Code Execution Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEJizbZSoQS0UAo6zMC_WNpxf0j775vuumnQDM0BN5teycio1A@mail.gmail.com>
Date: Wed, 22 Aug 2012 17:18:43 +0100
From: Benji <me@...ji.com>
To: ZDI Disclosures <zdi-disclosures@...pingpoint.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>,
	ZDI Disclosures <zdi-disclosures@...com>
Subject: Re: ZDI-12-149 : Cisco AnyConnect VPN Client
 Verification Bypass Remote Code Execution Vulnerability

" User interaction is required to exploit this vulnerability in that
the target must visit a malicious page or open a malicious file."

sorry, what?

On Wed, Aug 22, 2012 at 4:48 PM, ZDI Disclosures
<zdi-disclosures@...pingpoint.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> ZDI-12-149 : Cisco AnyConnect VPN Client Verification Bypass Remote Code
> Execution Vulnerability
> http://www.zerodayinitiative.com/advisories/ZDI-12-149
> August 22, 2012
>
> - -- CVE ID:
> CVE-2012-2494
>
> - -- CVSS:
> 9, AV:N/AC:L/Au:N/C:P/I:P/A:C
>
> - -- Affected Vendors:
> Cisco
>
> - -- Affected Products:
> Cisco AnyConnect VPN Client
>
> - -- Vulnerability Details:
> This vulnerability allows remote attackers to execute arbitrary code on
> vulnerable installations of Cisco AnyConnect VPN Client. User interaction
> is required to exploit this vulnerability in that the target must visit a
> malicious page or open a malicious file.
>
> The specific flaw exists because the VPN AnyConnect helper program does not
> check the version number of the vpndownloader.exe program it downloads. As
> such it is possible to forcefully install an older version of the
> vpndownloader.exe that is vulnerable to previously patched issues.
>
> - -- Vendor Response:
> Cisco has issued an update to correct this vulnerability. More details can
> be found at:
> http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-
> sa-20120620-ac
>
> - -- Disclosure Timeline:
> 2011-11-22 - Vulnerability reported to vendor
> 2012-08-22 - Coordinated public release of advisory
>
> - -- Credit:
> This vulnerability was discovered by:
> * gwslabs.com
>
> - -- About the Zero Day Initiative (ZDI):
> Established by TippingPoint, The Zero Day Initiative (ZDI) represents
> a best-of-breed model for rewarding security researchers for responsibly
> disclosing discovered vulnerabilities.
>
> Researchers interested in getting paid for their security research
> through the ZDI can find more information and sign-up at:
>
>     http://www.zerodayinitiative.com
>
> The ZDI is unique in how the acquired vulnerability information is
> used. TippingPoint does not re-sell the vulnerability details or any
> exploit code. Instead, upon notifying the affected product vendor,
> TippingPoint provides its customers with zero day protection through
> its intrusion prevention technology. Explicit details regarding the
> specifics of the vulnerability are not exposed to any parties until
> an official vendor patch is publicly available. Furthermore, with the
> altruistic aim of helping to secure a broader user base, TippingPoint
> provides this vulnerability information confidentially to security
> vendors (including competitors) who have a vulnerability protection or
> mitigation product.
>
> Our vulnerability disclosure policy is available online at:
>
>     http://www.zerodayinitiative.com/advisories/disclosure_policy/
>
> Follow the ZDI on Twitter:
>
>     http://twitter.com/thezdi
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP Desktop 10.2.0 (Build 1950)
> Charset: utf-8
>
> wsBVAwUBUDT/PFVtgMGTo1scAQLLzgf9HBKVYWR/BvvgxJa3/JvOrqcitJ3YJbtB
> w1mms3xSCBArm9xVo3FyeM4is6+94bG5v6gSD2Q774+1JP8eLsPSJgCGygL8qrxI
> jKKd2vpaIVEska4Q1yGBOaGh/Gbh6zoGOErL1KjbHD2nEG9olu8aKkMw+4JEPewe
> ZtL6XOAPZlPvpR9pG9nAxB4BqyhY10Hc+s35ovQIMQQO9S3GUR18GrVy+bXsQKpe
> nm6ovRLqHaSwq0hCHbHmhKwiCepqV+1KFy9aZSbCXU4VpiaO1N1llDB1L+o3g9bQ
> q9vBUrbuw4rJqb5hSdQSi+ZJylSVmuHTLo8tOHwXmJlK1lrs3lUiww==
> =8yO6
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/