PT-2010-2346 · Cisco · Cisco Secure Desktop

Published 2010-04-14 · Updated 2017-08-17 · CVE-2010-0589

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Secure Desktop versions prior to 3.5.841

Description The issue concerns the Web Install ActiveX control in Cisco Secure Desktop, which fails to properly verify the signatures of downloaded programs. This allows remote attackers to force the download and execution of arbitrary files via a crafted web page.

Recommendations For versions prior to 3.5.841, update to version 3.5.841 or later to resolve the issue. As a temporary workaround, consider disabling the use of the CSDWebInstaller ActiveX control until a patch is applied. Restrict access to web pages that could potentially exploit this issue to minimize the risk of remote code execution.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-0589

ZDI-10-072

Affected Products

Cisco Secure Desktop

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2010-0589 · Security Note
• http://cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-10-072 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-10-072 · Note
• http://securitytracker.com/id?1023881 · Note
• http://securityfocus.com/bid/39478 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/57812 · Note