PT-2007-2492 · Cisco+1 · Cisco Security Agent+2

Publicado 2007-02-22 · Atualizado 2017-07-29 · CVE-2007-1064

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco Secure Services Client (CSSC) versions 4.x Trust Agent versions 1.x through 2.x Cisco Security Agent (CSA) versions 5.0 through 5.1 Meetinghouse AEGIS SecureConnect Client (affected versions not specified)

Description: The issue allows local users to gain privileges when the help facility in the supplicant GUI is invoked, due to the failure to drop privileges.

Recommendations: For CSSC version 4.x, update to a version that drops privileges when the help facility is invoked. For Trust Agent versions 1.x through 2.x, update to a version that drops privileges when the help facility is invoked. For CSA versions 5.0 through 5.1, update to a version that drops privileges when the help facility is invoked, ensuring the vulnerable Trust Agent is not deployed. For Meetinghouse AEGIS SecureConnect Client, at the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2007-1064

Produtos afetados

Cisco Secure Services Client

Cisco Security Agent

Meetinghouse Aegis Secureconnect Client

Referências · 9

• http://vupen.com/english/advisories/2007/0690 · Nota
• http://osvdb.org/33049 · Nota
• http://cisco.com/warp/public/707/cisco-sa-20070221-supplicant.shtml · Aviso do Fabricante
• http://securityfocus.com/bid/22648 · Nota
• http://securitytracker.com/id?1017684 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1064 · Nota de Segurança
• http://secunia.com/advisories/24258 · Nota
• http://securitytracker.com/id?1017683 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32621 · Nota