Directory Traversal Vulnerability in AnyConnect

Vulnerability ID: HTB22629 Reference: http://www.htbridge.ch/advisory/directorytraversalvulnerabilityinanyconnect.html Product: AnyConnect Vendor: AnyConnect http://www.anyconnect.net Vulnerable Version: 1.2.3.0 and Probably Prior Versions Vendor Notification: 27 September 2010 Vulnerability Type...

CVE-2010-3901

OpenConnect before 2.25 is affected by CVE-2010-3901 due to improper validation of X.509 certificates, enabling MITM attacks where an attacker can spoof AnyConnect SSL VPN servers with a certificate that either does not match the server hostname or is presented when --cafile is not configured. Im...

CVE-2010-3903

Unspecified vulnerability in OpenConnect before 2.23 allows remote AnyConnect SSL VPN servers to cause a denial of service application crash via a 404 HTTP status code...

CVE-2009-5007

The Cisco trial client on Linux for Cisco AnyConnect SSL VPN allows local users to overwrite arbitrary files via a symlink attack on unspecified temporary files...

CVE-2010-3901

OpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that 1 does not correspond to the server hostname or 2 is presented in circumstances involving a missing...

CVE-2009-5009

OpenConnect vulnerability CVE-2009-5009: a double-free in the DTLS cipher option handling during reconnect on OpenConnect before 1.40 can cause denial of service (application crash) or unspecified impact on remote AnyConnect SSL VPN servers. Affected: OpenConnect

CVE-2010-3903

CVE-2010-3903 affects OpenConnect (before 2.23). The vulnerability allows remote denial of service (application crash) of an AnyConnect SSL VPN server by triggering a 404 HTTP response. The exact root cause, vulnerable component/file, and remediation are not detailed in the provided documents; ex...

CVE-2009-5007

The CVE-2009-5007 entry concerns the Cisco trial client on Linux for Cisco AnyConnect SSL VPN, where local users can overwrite arbitrary files via a symlink attack on unspecified temporary files. Affected component is the Linux client; root cause is a symlink-related path/temporary file handling ...

CVE-2009-5008

Cisco Secure Desktop CSD, when used in conjunction with an AnyConnect SSL VPN server, does not properly perform verification, which allows local users to bypass intended policy restrictions via a modified executable file...

CVE-2009-5009

Double free vulnerability in OpenConnect before 1.40 might allow remote AnyConnect SSL VPN servers to cause a denial of service application crash or possibly have unspecified other impact via a crafted DTLS Cipher option during a reconnect operation...

Directory Traversal Vulnerability in AnyConnect

High-Tech Bridge SA Security Research Lab has discovered vulnerability in AnyConnect which could be exploited to execute arbitrary code on vulnerable system. 1 Directory Traversal Vulnerability in AnyConnect: CVE-2010-4148 The vulnerability exists due to insufficient sanitation of the downloaded...

[SECURITY] Fedora 14 Update: openconnect-2.25-1.fc14

This package provides a client for Cisco's "AnyConnect" VPN, which uses HTTPS and DTLS protocols...

Fedora Update for openconnect FEDORA-2010-12253

Check for the Version of openconnect OpenVAS Vulnerability Test Fedora Update for openconnect FEDORA-2010-12253 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it und...

Fedora Update for openconnect FEDORA-2010-12257

Check for the Version of openconnect OpenVAS Vulnerability Test Fedora Update for openconnect FEDORA-2010-12257 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it und...

[SECURITY] Fedora 12 Update: openconnect-2.25-1.fc12

This package provides a client for Cisco's "AnyConnect" VPN, which uses HTTPS and DTLS protocols...

Cisco Security Advisory: Transport Layer Security Renegotiation Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Transport Layer Security Renegotiation Vulnerability Advisory ID: cisco-sa-20091109-tls http://www.cisco.com/warp/public/707/cisco-sa-20091109-tls.shtml Revision 1.0 For Public Release 2009 November 9 1600 UTC GMT Summary...

Cisco Security Advisory: Vulnerability in Cisco IOS While Processing SSL Packet

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Vulnerability in Cisco IOS While Processing SSL Packet Advisory ID: cisco-sa-20080924-ssl http://www.cisco.com/warp/public/707/cisco-sa-20080924-ssl.shtml Revision 1.0 For Public Release 2008 September 24 1600 UTC GMT -...

Cisco Security Advisory: Local Privilege Escalation Vulnerabilities in Cisco VPN Client

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Local Privilege Escalation Vulnerabilities in Cisco VPN Client Advisory ID: cisco-sa-20070815-vpnclient http://www.cisco.com/warp/public/707/cisco-sa-20070815-vpnclient.shtml Revision 1.0 For Public Release 2007 August 15 1600...