PT-2011-4022 · Cisco · Cisco Vpn Client

Gavin Jones · Publicado 2011-07-07 · Atualizado 2018-10-09 · CVE-2011-2678

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco VPN Client version 5.0.7.0240 Cisco VPN Client version 5.0.7.0290

Description The issue is related to weak permissions for the cvpnd.exe file, which can be exploited by local users to gain privileges. This is achieved by replacing the cvpnd.exe file with an arbitrary program.

Recommendations For Cisco VPN Client version 5.0.7.0240, update the permissions of cvpnd.exe to prevent local users from replacing the executable. For Cisco VPN Client version 5.0.7.0290, update the permissions of cvpnd.exe to prevent local users from replacing the executable.

Correção

Identificadores relacionados

CVE-2011-2678

Produtos afetados

Cisco Vpn Client

Referências · 6

• http://securityreason.com/securityalert/8297 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/68485 · Nota
• http://securityfocus.com/archive/1/518638/100/0/threaded · Nota
• http://isc.sans.edu/diary.html?storyid=11125 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-2678 · Nota de Segurança
• http://cisco.com/warp/public/707/cisco-sa-20070815-vpnclient.shtml · Aviso do Fabricante