PT-2011-3560 · Cisco · Cisco Anyconnect Secure Mobility Client+1

Published 2011-06-02 · Updated 2017-08-29 · CVE-2011-2039

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client versions prior to 2.3.185

Description The issue allows remote attackers to execute arbitrary code due to the helper application downloading a client executable file without verifying its authenticity. This is achieved via the url property to a certain ActiveX control in vpnweb.ocx.

Recommendations For versions prior to 2.3.185, update to version 2.3.185 or later to resolve the issue. As a temporary workaround, consider restricting access to the vpnweb.ocx ActiveX control to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-2039

Affected Products

Cisco Anyconnect Secure Mobility Client

Vpnweb.Ocx

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/cisco_anyconnect_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/17366 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-2039 · Security Note
• http://cisco.com/en/US/products/products_security_advisory09186a0080b80123.shtml · Vendor Advisory
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=909 · Note
• http://kb.cert.org/vuls/id/490097 · Note
• http://securitytracker.com/id?1025591 · Note
• http://securityreason.com/securityalert/8272 · Note
• http://osvdb.org/72714 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67739 · Note