PT-2016-6850 · Cisco · Cisco Anyconnect Secure Mobility Client

Publicado 2016-08-25 · Atualizado 2016-12-12 · CVE-2016-6369

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client versions prior to 4.2.05015 Cisco AnyConnect Secure Mobility Client versions 4.3.x prior to 4.3.02039

Description The issue is related to the mishandling of pathnames by the software, allowing local users to gain privileges via a crafted INF file.

Recommendations For versions prior to 4.2.05015, update to version 4.2.05015 or later. For versions 4.3.x prior to 4.3.02039, update to version 4.3.02039 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-6369

Produtos afetados

Cisco Anyconnect Secure Mobility Client

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-6369 · Nota de Segurança
• http://securitytracker.com/id/1036697 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160824-anyconnect · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-6369 · Aviso do Fabricante
• http://securityfocus.com/bid/92625 · Nota