CVE-2012-2494

The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 and 3.x before 3.0 MR8 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a version downgrade by...

ZDI-12-149 : Cisco AnyConnect VPN Client Verification Bypass Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-149 : Cisco AnyConnect VPN Client Verification Bypass Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-149 August 22, 2012 - -- CVE ID: CVE-2012-2494 - -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C - -- Affected...

CVE-2012-2494

CVE-2012-2494 affects Cisco AnyConnect Secure Mobility Client: the VPN WebLaunch downloader does not compare the timestamp of the offered vpndownloader.exe with the installed version, enabling a downgrade to older releases. Affected product/version ranges include Cisco AnyConnect Secure Mobility ...