PT-2007-2495 · Cisco+1 · Trust Agent+3

Published 2007-02-22 · Updated 2017-07-29 · CVE-2007-1067

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco Secure Services Client (CSSC) versions 4.x Trust Agent versions 1.x through 2.x Cisco Security Agent (CSA) versions 5.0 through 5.1 Meetinghouse AEGIS SecureConnect Client (affected versions not specified)

Description: The issue is related to improper command parsing, which allows local users to gain privileges.

Recommendations: For CSSC version 4.x, update to a version that properly parses commands. For Trust Agent versions 1.x through 2.x, update to a version that properly parses commands. For CSA versions 5.0 through 5.1, update to a version that properly parses commands, ensuring that any vulnerable Trust Agent has been updated. For Meetinghouse AEGIS SecureConnect Client, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2007-1067

Affected Products

Cisco Secure Services Client

Cisco Security Agent

Meetinghouse Aegis Secureconnect Client

Trust Agent

References · 9

• http://cisco.com/warp/public/707/cisco-sa-20070221-supplicant.shtml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1067 · Security Note
• http://vupen.com/english/advisories/2007/0690 · Note
• http://securityfocus.com/bid/22648 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32624 · Note
• http://osvdb.org/33045 · Note
• http://securitytracker.com/id?1017684 · Note
• http://secunia.com/advisories/24258 · Note
• http://securitytracker.com/id?1017683 · Note