{"id": "CVE-2006-5808", "bulletinFamily": "NVD", "title": "CVE-2006-5808", "description": "The installation of Cisco Secure Desktop (CSD) before 3.1.1.45 uses insecure default permissions (all users full control) for the CSD directory and its parent directory, which allow local users to gain privileges by replacing CSD executables, aka \"Local Privilege Escalation\".\nThis vulnerability is addressed in the following product release:\r\nCisco, Cisco Secure Desktop, 3.1.1.45", "published": "2006-11-08T22:07:00", "modified": "2017-07-20T01:33:00", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-5808", "reporter": "cve@mitre.org", "references": ["http://secunia.com/advisories/22747", "http://www.osvdb.org/30308", "http://www.securityfocus.com/bid/20964", "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=442", "http://securitytracker.com/id?1017195", "http://www.vupen.com/english/advisories/2006/4409", "https://exchange.xforce.ibmcloud.com/vulnerabilities/30128", "http://www.cisco.com/warp/public/707/cisco-sa-20061108-csd.shtml"], "cvelist": ["CVE-2006-5808"], "type": "cve", "lastseen": "2019-05-29T18:08:34", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "de96fdd17f2547e07bb928b9f87d827e"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "ed03f06acf8bc123b619683c78ca932f"}, {"key": "cpe23", "hash": "a47ac58289299537d1fa108f4f4bbf61"}, {"key": "cvelist", "hash": "b17826598d6afa4fb5b04b4aca0ed72d"}, {"key": "cvss", "hash": "6f6410364e4cee78bd47ed1fc3d8dd5b"}, {"key": "cvss2", "hash": "a20e5567f34056412c98626d7c0696f5"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "78a7a5cbaf09985c14389298e454e7db"}, {"key": "description", "hash": "63c2fec9dffa53b1e82b3e8c773cf9e9"}, {"key": "href", "hash": "2880c77e1bd3119dca254d52a62aec9d"}, {"key": "modified", "hash": "0fdb701905e0138e4bc209297c27fd37"}, {"key": "published", "hash": "d117bd07cd0f1d4d20836171e27f24d3"}, {"key": "references", "hash": "a431b17b7518c2316a44bc96e6c7a9fe"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "0cee6fca8eaed1240106c4fde04c8b7c"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "07d7a413bd6478531e045c18d6bd5b7b3a271e0538ea48ee153e9acc603aea08", "viewCount": 0, "enchantments": {"score": {"value": 6.0, "vector": "NONE", "modified": "2019-05-29T18:08:34"}, "dependencies": {"references": [{"type": "osvdb", "idList": ["OSVDB:30308"]}, {"type": "cisco", "idList": ["CISCO-SA-20061108-CSD"]}], "modified": "2019-05-29T18:08:34"}, "vulnersScore": 6.0}, "objectVersion": "1.3", "cpe": ["cpe:/a:cisco:secure_desktop:3.1.1.27"], "affectedSoftware": [{"name": "cisco secure_desktop", "operator": "eq", "version": "3.1.1.27"}, {"name": "cisco secure_desktop", "operator": "le", "version": "3.1.1.33"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": true, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:a:cisco:secure_desktop:3.1.1.27:*:*:*:*:*:*:*"], "cwe": ["NVD-CWE-Other"]}

{"osvdb": [{"lastseen": "2017-04-28T13:20:26", "bulletinFamily": "software", "description": "## Vulnerability Description\nCisco Secure Desktop contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when the Web VPN product is installed on a NTFS formatted drive, and permissions are set to full control for all users. Several executable run with System privileges, and are easily replaced. This flaw may lead to a loss of integrity.\n## Solution Description\nUpgrade to version 3.1.1.45 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nCisco Secure Desktop contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when the Web VPN product is installed on a NTFS formatted drive, and permissions are set to full control for all users. Several executable run with System privileges, and are easily replaced. This flaw may lead to a loss of integrity.\n## References:\nVendor URL: http://www.cisco.com/warp/public/707/cisco-sa-20061108-csd.shtml\nVendor URL: http://www.cisco.com\n[Secunia Advisory ID:22747](https://secuniaresearch.flexerasoftware.com/advisories/22747/)\n[Related OSVDB ID: 30306](https://vulners.com/osvdb/OSVDB:30306)\n[Related OSVDB ID: 30307](https://vulners.com/osvdb/OSVDB:30307)\nOther Advisory URL: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=442\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-11/0132.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-11/0120.html\nISS X-Force ID: 30128\nFrSIRT Advisory: ADV-2006-4409\n[CVE-2006-5808](https://vulners.com/cve/CVE-2006-5808)\nBugtraq ID: 20964\n", "modified": "2006-11-08T10:18:47", "published": "2006-11-08T10:18:47", "href": "https://vulners.com/osvdb/OSVDB:30308", "id": "OSVDB:30308", "title": "Cisco Secure Desktop (CSD) Installation Permission Weakness Local Privilege Escalation", "type": "osvdb", "cvss": {"score": 4.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "cisco": [{"lastseen": "2019-05-29T15:33:21", "bulletinFamily": "software", "description": "", "modified": "2006-11-08T16:00:00", "published": "2006-11-08T16:00:00", "id": "CISCO-SA-20061108-CSD", "href": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20061108-csd", "type": "cisco", "title": "Multiple Vulnerabilities in Cisco Secure Desktop", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}]}