PT-2012-4470 · Cisco · Cisco Anyconnect Secure Mobility Client

Published 2012-09-16 · Updated 2017-08-29 · CVE-2012-3088

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client versions 3.1.x before 3.1.00495 Cisco AnyConnect Secure Mobility Client version 3.2.x

Description The issue allows remote attackers to have an unspecified impact via a crafted HTTP request, as the software does not check whether the request originally contains ScanSafe headers.

Recommendations For Cisco AnyConnect Secure Mobility Client versions 3.1.x before 3.1.00495, update to version 3.1.00495 or later. For Cisco AnyConnect Secure Mobility Client version 3.2.x, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2012-3088

Affected Products

Cisco Anyconnect Secure Mobility Client

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-3088 · Security Note
• http://cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect31/release/notes/anyconnect31rn.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78920 · Note