PT-2006-6483 · Cisco · Cisco Secure Desktop

Published 2006-11-08 · Updated 2017-07-20 · CVE-2006-5806

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Secure Desktop versions prior to 3.1.1.45

Description: The issue concerns the storage of sensitive browser session information in a directory outside of the vault when the SSL VPN Client is configured to spawn a web browser after a successful connection. This information is not cleared after the VPN connection terminates, allowing local users to read unencrypted data. The lack of restriction on saving files outside of the vault further exacerbates the issue.

Recommendations: For versions prior to 3.1.1.45, update to version 3.1.1.45 or later to resolve the issue. As a temporary workaround, consider restricting user access to sensitive directories and implementing additional security measures to protect unencrypted data.

Fix

Related Identifiers

CVE-2006-5806

Affected Products

Cisco Secure Desktop

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-5806 · Security Note
• http://cisco.com/warp/public/707/cisco-sa-20061108-csd.shtml · Vendor Advisory
• http://securitytracker.com/id?1017195 · Note
• http://securityfocus.com/bid/20964 · Note
• http://vupen.com/english/advisories/2006/4409 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30129 · Note
• http://secunia.com/advisories/22747 · Note
• http://osvdb.org/30306 · Note