PT-2010-2346 · Cisco · Cisco Secure Desktop

Publicado 2010-04-14 · Atualizado 2017-08-17 · CVE-2010-0589

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Secure Desktop versions prior to 3.5.841

Description The issue concerns the Web Install ActiveX control in Cisco Secure Desktop, which fails to properly verify the signatures of downloaded programs. This allows remote attackers to force the download and execution of arbitrary files via a crafted web page.

Recommendations For versions prior to 3.5.841, update to version 3.5.841 or later to resolve the issue. As a temporary workaround, consider disabling the use of the CSDWebInstaller ActiveX control until a patch is applied. Restrict access to web pages that could potentially exploit this issue to minimize the risk of remote code execution.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2010-0589

ZDI-10-072

Produtos afetados

Cisco Secure Desktop

Referências · 7

• http://zerodayinitiative.com/advisories/ZDI-10-072 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0589 · Nota de Segurança
• http://cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml · Aviso do Fabricante
• http://securitytracker.com/id?1023881 · Nota
• http://securityfocus.com/bid/39478 · Nota
• https://zerodayinitiative.com/advisories/ZDI-10-072 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/57812 · Nota