KLA10103 LPE vulnerability in Cisco AnyConnect

2013-04-1100:00:00

Kaspersky Lab

threats.kaspersky.com

6.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:S/C:C/I:C/A:C

7.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

A buffer overflow was found in Cisco AnyConnect. By exploiting this vulnerability malicious users can gain privileges. This vulnerability can be exploited locally.

Original advisories

Cisco bulletin

Related products

Cisco-AnyConnect-VPN-Client

CVE list

CVE-2013-1173 high

Solution

Update to latest version

Impacts

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.