Cisco AnyConnect Secure Mobility Client < 3.1(7021) / <= 4.0(48) Multiple Vulnerabilities (FREAK)

The remote host has a version of Cisco AnyConnect Secure Mobility Client installed that is prior to 3.1.7021.0, or else it is a version equal or prior to 4.0.0048.0. It is, therefore, affected by multiple vulnerabilities in the OpenSSL library : - The BIGNUM squaring BNsqr implementation does not...

Mac OS X : Cisco AnyConnect Secure Mobility Client < 3.1.10010.0 / 4.0.x < 4.0.4014.0 / 4.1.x < 4.1.4011.0 Code Execution Vulnerability

The Cisco AnyConnect Secure Mobility Client installed on the remote Mac OS X host is a version prior to 3.1.10010.0, or is version 4.0.x prior to 4.0.4014.0, or version 4.1.x prior to 4.1.4011.0. It is, therefore, affected by a flaw that allows unauthenticated IPC commands to install software as...

Cisco AnyConnect Secure Mobility Client < 3.1.10010.0 / 4.0.x < 4.0.4014.0 / 4.1.x < 4.1.4011.0 Code Execution Vulnerability

The Cisco AnyConnect Secure Mobility Client installed on the remote host is a version prior to 3.1.10010.0, or is version 4.0.x prior to 4.0.4014.0, or version 4.1.x prior to 4.1.4011.0. It is, therefore, affected by a flaw that allows unauthenticated IPC commands to install software as root. A...

Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability (CNVD-2015-01868)

The Cisco AnyConnect Secure Mobility Client is Cisco's next-generation VPN client. Cisco AnyConnect Secure Mobility Client 4.0 .00051 and prior versions contain a security vulnerability in the IPC channel, which can be exploited by a local user to write to any user-space memory location via a...

Memory corruption

The IPC channel in Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier allows local users to write to arbitrary userspace memory locations, and consequently gain privileges, via crafted messages, aka Bug ID CSCus79195...

CVE-2015-0664

The IPC channel in Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier allows local users to write to arbitrary userspace memory locations, and consequently gain privileges, via crafted messages, aka Bug ID CSCus79195...

CVE-2015-0664

Cisco AnyConnect Secure Mobility Client (affected: 4.0(.00051) and earlier) contains an IPC channel vulnerability (CVE-2015-0664) that allows a local attacker to write to arbitrary user-space memory and escalate privileges via specially crafted IPC messages. Multiple Nessus/Cisco advisories reite...

Cisco AnyConnect Secure Mobility Client Hostscan Path Traversal Vulnerability

The Cisco AnyConnect Secure Mobility Client is Cisco's next-generation VPN client. A security vulnerability exists in the Interprocess Communication IPC of the Cisco AnyConnect Secure Mobility Client Hostscan module, which allows a local attacker to write and overwrite arbitrary files with elevat...

Cisco AnyConnect Secure Mobility Client Arbitrary File Write Vulnerability

The Cisco AnyConnect Secure Mobility Client is Cisco's next-generation VPN client. The Cisco AnyConnect Secure Mobility Client has a security vulnerability in inter-process communication IPC that allows a local attacker to write and overwrite arbitrary files with elevated privileges...

Cisco AnyConnect Secure Mobility Client Elevation of Privilege Vulnerability

The Cisco AnyConnect Secure Mobility Client is Cisco's next-generation VPN client. Cisco AnyConnect Secure Mobility Client has a security vulnerability in interprocess communication IPC that allows a local attacker to write and overwrite arbitrary files with elevated privileges...

CVE-2015-0665

The Hostscan module in Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier allows local users to write to arbitrary files via crafted IPC messages, aka Bug ID CSCus79173...

CVE-2015-0663

Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier does not properly implement access control for IPC messages, which allows local users to write to arbitrary files via crafted messages, aka Bug ID CSCus79392...

CVE-2015-0662

Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a software-package installation, aka Bug ID CSCus79385...

Improper access control

Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier does not properly implement access control for IPC messages, which allows local users to write to arbitrary files via crafted messages, aka Bug ID CSCus79392...

Code injection

The Hostscan module in Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier allows local users to write to arbitrary files via crafted IPC messages, aka Bug ID CSCus79173...

Code injection

Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a software-package installation, aka Bug ID CSCus79385...

CVE-2015-0662

Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a software-package installation, aka Bug ID CSCus79385...

CVE-2015-0665

The Hostscan module in Cisco AnyConnect Secure Mobility Client 4.0.00051 and earlier allows local users to write to arbitrary files via crafted IPC messages, aka Bug ID CSCus79173...

CVE-2015-0663

The CVE-2015-0663 entry covers Cisco AnyConnect Secure Mobility Client IPC access control weakness. Affected software: Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier. Vulnerability: improper access control for IPC messages that allows a local, authenticated/at least local user to...

CVE-2015-0665

CVE-2015-0665 affects Cisco AnyConnect Secure Mobility Client via the Hostscan IPC path traversal. A local authenticated attacker can exploit crafted IPC commands to write or overwrite arbitrary files. Affected: 4.0(.00051) and earlier Hostscan IPC handling (path traversal vulnerability). Impact:...