PT-2012-5528 · Cisco · Cisco Secure Desktop

Publicado 2012-09-24 · Atualizado 2017-08-29 · CVE-2012-4655

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Secure Desktop versions prior to 3.6.6020

Description The issue is related to the WebLaunch feature, which does not properly validate binaries received by the downloader process. This allows remote attackers to execute arbitrary code via vectors involving ActiveX or Java components.

Recommendations For versions prior to 3.6.6020, update to version 3.6.6020 or later to resolve the issue. As a temporary workaround, consider disabling the WebLaunch feature until a patch is available. Restrict access to ActiveX and Java components to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2012-4655

Produtos afetados

Cisco Secure Desktop

Referências · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/78677 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4655 · Nota de Segurança
• http://securityfocus.com/bid/55606 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac · Aviso do Fabricante
• http://secunia.com/advisories/50669 · Nota