PT-2006-6483 · Cisco · Cisco Secure Desktop

Publicado 2006-11-08 · Atualizado 2017-07-20 · CVE-2006-5806

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Secure Desktop versions prior to 3.1.1.45

Description: The issue concerns the storage of sensitive browser session information in a directory outside of the vault when the SSL VPN Client is configured to spawn a web browser after a successful connection. This information is not cleared after the VPN connection terminates, allowing local users to read unencrypted data. The lack of restriction on saving files outside of the vault further exacerbates the issue.

Recommendations: For versions prior to 3.1.1.45, update to version 3.1.1.45 or later to resolve the issue. As a temporary workaround, consider restricting user access to sensitive directories and implementing additional security measures to protect unencrypted data.

Correção

Identificadores relacionados

CVE-2006-5806

Produtos afetados

Cisco Secure Desktop

Referências · 8

• http://securitytracker.com/id?1017195 · Nota
• http://securityfocus.com/bid/20964 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5806 · Nota de Segurança
• http://vupen.com/english/advisories/2006/4409 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30129 · Nota
• http://cisco.com/warp/public/707/cisco-sa-20061108-csd.shtml · Aviso do Fabricante
• http://secunia.com/advisories/22747 · Nota
• http://osvdb.org/30306 · Nota