Cisco AnyConnect VPN Client ActiveX URL Property Download and Execute

Exploit for windows platform in category remote exploits $Id: ciscoanyconnectexec.rb 12872 2011-06-06 20:15:51Z bannedit $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more...

Cisco AnyConnect SSL VPN arbitrary code execution

Overview The Cisco AnyConnect SSL VPN ActiveX and Java clients contain a vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Cisco AnyConnect is an SSL VPN solution that is commonly initiated through use of a web browser...

Cisco AnyConnect VPN Client - ActiveX URL Property Download and Execute (Metasploit)

$Id: ciscoanyconnectexec.rb 12872 2011-06-06 20:15:51Z bannedit $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Cisco AnyConnect Secure Mobility Client任意代码执行及本地特权提升漏洞

Bugtraq ID: 48081,48087 CVE ID：CVE-2011-2039 CVE-2011-2040 CVE-2011-2041 Cisco AnyConnect Secure Mobility Client是思科公司提供的远端存取解决方案，是思科的下一代VPN客户端。 Cisco AnyConnect安全移动客户端存在如下漏洞： -任意程序执行漏洞CVE-2011-2040 当从VPN前端部署Cisco AnyConnect安全移动客户端时，会使用WEB浏览器向VPN前端初始化一个SSL连接。在用户登录后，浏览器会显示门户窗口，当用户点击"Start...

GE Intelligent Platforms Proficy Plant Applications Buffer Overflow

Overview ICS CERT originally released Advisory ICSA-11-243-01P on the US-CERT secure Portal on August 31, 2011. This web page release was delayed to allow users time to download and install the update. ICS-CERT has received a report from GE concerning a stack-based buffer overflow vulnerability i...

Cisco AnyConnect Secure Mobility Client Detection

Cisco AnyConnect Secure Mobility Client formerly known as Cisco AnyConnect VPN Client is installed on the remote Windows host. This software can be used for secure connectivity. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid54953; scriptversion"1.15";...

iDefense Security Advisory 06.01.11: Cisco AnyConnect VPN Client Arbitrary Program Execution Vulnerability

iDefense Security Advisory 06.01.11 http://labs.idefense.com/intelligence/vulnerabilities/ Jun 01, 2011 I. BACKGROUND Cisco's AnyConnect VPN solution provides remote access to customers via the Web browser. This is accomplished through the use of an ActiveX control. The control itself is provided...

Cisco AnyConnect Secure Mobility Client < 2.3.254 Multiple Vulnerabilities

The version of Cisco AnyConnect Secure Mobility Client installed on the remote host is earlier than 2.3.254 and may have the following vulnerabilities : - When the client is obtained from the VPN headend using a web browser, a helper application performs the download and installation. This helper...

CVE-2011-2040

The helper application in Cisco AnyConnect Secure Mobility Client formerly AnyConnect VPN Client before 2.5.3041, and 3.0.x before 3.0.629, on Linux and Mac OS X downloads a client executable file vpndownloader.exe without verifying its authenticity, which allows remote attackers to execute...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client Advisory ID: cisco-sa-20110601-ac Revision 1.0 For Public Release 2011 June 01 1600 UTC GMT...

Cisco AnyConnect VPN Client ActiveX URL Property Download and Execute

This module exploits a vulnerability in the Cisco AnyConnect VPN client vpnweb.ocx ActiveX control. This control is typically used to install the VPN client. An attacker can set the 'url' property which is where the control tries to locate the files needed to install the client. The control tries...

Cisco Secure Desktop CSDWebInstaller Code Execution (CVE-2011-0926)

Cisco Secure Desktop is multipurpose client-side VPN software that is used in a broader enterprise context. A remote code execution vulnerability exists in Cisco Secure Desktop. The vulnerability is due to a lack of validation of executables downloaded by the Secure Desktop Web CSDWebInstaller.oc...

China plugging holes in its Great Firewall by disrupting VPN traffic !

China plugging holes in its Great Firewall by disrupting VPN traffic ! Chinese internet users suspect that their government is interfering with the method they have been using to tunnel under the "Great Firewall" to prevent them connecting with the outside world. Sites such as search engine Googl...

Scadatec Limited Procyon Telnet Buffer Overflow

Overview ICS-CERT originally released Advisory ICSA-11-216-01P on the US-CERT Portal on August 04, 2011. This web page release was delayed to allow users sufficient time to download and install the update. ICS-CERT has received a report from Knud Højgaard of the nSense Vulnerability Coordination...

[RT-SA-2011-004] Client Side Authorization ZyXEL ZyWALL USG Appliances Web Interface

Advisory: Client Side Authorization ZyXEL ZyWALL USG Appliances Web Interface The ZyXEL ZyWALL USG appliances perform parts of the authorization for their management web interface on the client side using JavaScript. By setting the JavaScript variable "isAdmin" to "true", a user with limited acce...

Check Point SSL VPN On-Demand应用程序远程代码执行漏洞

Bugtraq ID: 47695 CVE ID：CVE-2011-1827 SNX SecureWorkSpace和Endpoint Security On-Demand可从Connectra或security gateways下载的客户端，可实现按需远程连接。它们可使用Check Point Deployment Agent Java applet或ActiveX控件配置在浏览中。 应用程序SSL网络扩展器SNX, SecureWorkSpace和Endpoint Security On-Demand通过浏览器配置时，容易受到恶意网站的攻击，导致在末端用户机器上执行任意恶意代码。...

Security issue in SSL VPN On-Demand applications

...

MS11-030: Vulnerability in DNS Resolution could allow remote code execution: April 12, 2011

None None...

Cisco VPN privileges escalation

Privilege escalation via Dial-Up Networking interface...

NGS00051 Patch Notification: Cisco VPN Client Privilege Escalation

High Risk Vulnerability in Cisco VPN client Windows 64 bit 25 March 2011 Gavin Jones of NGS Secure has discovered a High risk vulnerability in the Cisco VPN client Windows 64 bit. Impact: Privilege Escalation Cisco has released a patch that addresses the issue. The announcement of this patch can ...