Cisco Host Scan Component of AnyConnect Secure Mobility and Secure Desktop Heap Overflow Vulnerability

The Cisco Host Scan component of Cisco AnyConnect Secure Mobility and Cisco Secure Desktop contains a heap overflow vulnerability that could allow a local, unprivileged user to elevate its privileges to those of SYSTEM.

Cisco has confirmed the vulnerability in a security notice and software updates are available.

To exploit this vulnerability, the attacker must have local access to a targeted system. This access restriction limits the possibility of a successful exploit.

Customers are advised to review the bug report in the Vendor Announcements section for a current list of affected versions.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.