CVE-2015-6305

2015-09-2601:59:00

CWE-426

[email protected]

web.nvd.nist.gov

cve-2015-6305

untrusted search path vulnerability

cmainthread::launchdownloader

cisco anyconnect secure mobility client

windows

local users

privileges

cve-2015-4211

6.4 Medium

AI Score

Confidence

High

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

39.8%

JSON

Untrusted search path vulnerability in the CMainThread::launchDownloader function in vpndownloader.exe in Cisco AnyConnect Secure Mobility Client 2.0 through 4.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by dbghelp.dll, aka Bug ID CSCuv01279. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4211.

CPENameOperatorVersion
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.0.0343
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.1.0.148
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.2.0133
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.2.0136
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.2.0140
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.3.0185
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.3.0254
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.3.1003
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.3.2016
cisco:anyconnect_secure_mobility_clientcisco anyconnect secure mobility clienteq2.4.0202

CPE	Name	Operator	Version
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.0.0343
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.1.0.148
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.2.0133
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.2.0136
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.2.0140
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.3.0185
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.3.0254
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.3.1003
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.3.2016
cisco:anyconnect_secure_mobility_client	cisco anyconnect secure mobility client	eq	2.4.0202