Sign-up

ID

VAR-201206-0086


CVE

CVE-2012-2494


TITLE

Cisco AnyConnect Secure Mobility Client Vulnerabilities forced to downgrade versions

Trust: 0.8

sources: JVNDB: JVNDB-2012-002811

DESCRIPTION

The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 and 3.x before 3.0 MR8 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a version downgrade by using (1) ActiveX or (2) Java components to offer signed code that corresponds to an older software release, aka Bug ID CSCtw48681. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cisco AnyConnect VPN Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists because the VPN AnyConnect helper program does not check the version number of the vpndownloader.exe program it downloads. As such it is possible to forcefully install an older version of the vpndownloader.exe that is vulnerable to previously patched issues. This older version of the client software may contain vulnerabilities which can be exploited by the attacker to perform further attacks. These issues are tracked by Cisco Bug IDs CSCtw48681 and CSCtx74235. Cisco AnyConnect Secure Mobility is a secure enterprise mobility solution. Also known as Bug ID CSCtw48681. - -- Vendor Response: Cisco has issued an update to correct this vulnerability. More details can be found at: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco- sa-20120620-ac - -- Disclosure Timeline: 2011-11-22 - Vulnerability reported to vendor 2012-08-22 - Coordinated public release of advisory - -- Credit: This vulnerability was discovered by: * gwslabs.com - -- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities. Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at: http://www.zerodayinitiative.com The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product. Our vulnerability disclosure policy is available online at: http://www.zerodayinitiative.com/advisories/disclosure_policy/ Follow the ZDI on Twitter: http://twitter.com/thezdi -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 10.2.0 (Build 1950) Charset: utf-8 wsBVAwUBUDT/PFVtgMGTo1scAQLLzgf9HBKVYWR/BvvgxJa3/JvOrqcitJ3YJbtB w1mms3xSCBArm9xVo3FyeM4is6+94bG5v6gSD2Q774+1JP8eLsPSJgCGygL8qrxI jKKd2vpaIVEska4Q1yGBOaGh/Gbh6zoGOErL1KjbHD2nEG9olu8aKkMw+4JEPewe ZtL6XOAPZlPvpR9pG9nAxB4BqyhY10Hc+s35ovQIMQQO9S3GUR18GrVy+bXsQKpe nm6ovRLqHaSwq0hCHbHmhKwiCepqV+1KFy9aZSbCXU4VpiaO1N1llDB1L+o3g9bQ q9vBUrbuw4rJqb5hSdQSi+ZJylSVmuHTLo8tOHwXmJlK1lrs3lUiww== =8yO6 -----END PGP SIGNATURE-----

Trust: 2.7

sources: NVD: CVE-2012-2494 // JVNDB: JVNDB-2012-002811 // ZDI: ZDI-12-149 // BID: 54108 // VULHUB: VHN-55775 // PACKETSTORM: 115785

AFFECTED PRODUCTS

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0

Trust: 1.9

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5

Trust: 1.9

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.3.254

Trust: 1.9

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.3.185

Trust: 1.9

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.3

Trust: 1.9

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.4

Trust: 1.6

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.4.0202

Trust: 1.6

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.3.2016

Trust: 1.6

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.2.140

Trust: 1.6

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.4.1012

Trust: 1.6

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.2

Trust: 1.0

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.2.136

Trust: 1.0

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.1

Trust: 1.0

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.0

Trust: 1.0

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.2.133

Trust: 1.0

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.2.128

Trust: 1.0

vendor:ciscomodel:anyconnect secure mobility clientscope:ltversion:2.x

Trust: 0.8

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5 mr6

Trust: 0.8

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0 mr8

Trust: 0.8

vendor:ciscomodel:anyconnect secure mobility clientscope:ltversion:3.x

Trust: 0.8

vendor:ciscomodel:anyconnect vpn clientscope: - version: -

Trust: 0.7

vendor:ciscomodel:secure desktopscope:eqversion:3.5.1077

Trust: 0.3

vendor:ciscomodel:secure desktopscope:eqversion:3.5.841

Trust: 0.3

vendor:ciscomodel:secure desktopscope:eqversion:3.4.2048

Trust: 0.3

vendor:ciscomodel:secure desktopscope:eqversion:3.1.1

Trust: 0.3

vendor:ciscomodel:secure desktopscope:eqversion:3.2

Trust: 0.3

vendor:ciscomodel:secure desktopscope:eqversion:3.1.1.45

Trust: 0.3

vendor:ciscomodel:secure desktopscope:eqversion:3.1.1.33

Trust: 0.3

vendor:ciscomodel:secure desktopscope:eqversion:3.1

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.629

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.3046

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.3041

Trust: 0.3

sources: ZDI: ZDI-12-149 // BID: 54108 // JVNDB: JVNDB-2012-002811 // CNNVD: CNNVD-201206-374 // NVD: CVE-2012-2494

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-2494
value: MEDIUM

Trust: 1.0

NVD: CVE-2012-2494
value: MEDIUM

Trust: 0.8

ZDI: CVE-2012-2494
value: HIGH

Trust: 0.7

CNNVD: CNNVD-201206-374
value: MEDIUM

Trust: 0.6

VULHUB: VHN-55775
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2012-2494
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

ZDI: CVE-2012-2494
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 8.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

VULHUB: VHN-55775
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: ZDI: ZDI-12-149 // VULHUB: VHN-55775 // JVNDB: JVNDB-2012-002811 // CNNVD: CNNVD-201206-374 // NVD: CVE-2012-2494

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-55775 // JVNDB: JVNDB-2012-002811 // NVD: CVE-2012-2494

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 115785 // CNNVD: CNNVD-201206-374

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201206-374

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2012-002811

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-55775

PATCH
title:cisco-sa-20120620-acurl:http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac
Trust: 1.5
title:26197url:http://tools.cisco.com/security/center/viewAlert.x?alertId=26197
Trust: 0.8
title:Update Rollup for ActiveX Kill Bits (2736233)url:http://technet.microsoft.com/en-us/security/advisory/2736233
Trust: 0.8
title:Java SE Development Kit 7, Update 9 (JDK 7u9)url:http://www.oracle.com/technetwork/java/javase/7u9-relnotes-1863279.html
Trust: 0.8
title:Java SE Development Kit 6, Update 37 (JDK 6u37)url:http://www.oracle.com/technetwork/java/javase/6u37-relnotes-1863283.html
Trust: 0.8
title:cisco-sa-20120620-acurl:http://www.cisco.com/cisco/web/support/JP/111/1115/1115492_cisco-sa-20120620-ac-j.html
Trust: 0.8
title:ActiveX の Kill Bit 更新プログラムのロールアップ (2736233)url:http://technet.microsoft.com/ja-jp/security/advisory/2736233
Trust: 0.8
sources:
            
            
            ZDI: ZDI-12-149 // 
            
            
            
            JVNDB: JVNDB-2012-002811

EXTERNAL IDS
db:NVDid:CVE-2012-2494
Trust: 3.6
db:ZDIid:ZDI-12-149
Trust: 1.1
db:JVNDBid:JVNDB-2012-002811
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-1412
Trust: 0.7
db:CNNVDid:CNNVD-201206-374
Trust: 0.7
db:CISCOid:20120620 MULTIPLE VULNERABILITIES IN CISCO ANYCONNECT SECURE MOBILITY CLIENT
Trust: 0.6
db:NSFOCUSid:19866
Trust: 0.6
db:BIDid:54108
Trust: 0.3
db:PACKETSTORMid:115785
Trust: 0.2
db:VULHUBid:VHN-55775
Trust: 0.1
sources:
            
            
            ZDI: ZDI-12-149 // 
            
            
            
            VULHUB: VHN-55775 // 
            
            
            
            BID: 54108 // 
            
            
            
            JVNDB: JVNDB-2012-002811 // 
            
            
            
            PACKETSTORM: 115785 // 
            
            
            
            CNNVD: CNNVD-201206-374 // 
            
            
            
            NVD: CVE-2012-2494

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20120620-ac
Trust: 2.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2494
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-2494
Trust: 0.8
url:http://www.nsfocus.net/vulndb/19866
Trust: 0.6
url:http://www.cisco.com/
Trust: 0.3
url:http://technet.microsoft.com/en-us/security/advisory/2736233
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-12-149/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/disclosure_policy/
Trust: 0.1
url:http://twitter.com/thezdi
Trust: 0.1
url:http://www.zerodayinitiative.com/advisories/zdi-12-149
Trust: 0.1
url:http://www.zerodayinitiative.com
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2012-2494
Trust: 0.1
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-
Trust: 0.1
sources:
            
            
            ZDI: ZDI-12-149 // 
            
            
            
            VULHUB: VHN-55775 // 
            
            
            
            BID: 54108 // 
            
            
            
            JVNDB: JVNDB-2012-002811 // 
            
            
            
            PACKETSTORM: 115785 // 
            
            
            
            CNNVD: CNNVD-201206-374 // 
            
            
            
            NVD: CVE-2012-2494

CREDITS
gwslabs.com
Trust: 0.7
sources:
            
            
            ZDI: ZDI-12-149

SOURCES
db:ZDIid:ZDI-12-149
db:VULHUBid:VHN-55775
db:BIDid:54108
db:JVNDBid:JVNDB-2012-002811
db:PACKETSTORMid:115785
db:CNNVDid:CNNVD-201206-374
db:NVDid:CVE-2012-2494

LAST UPDATE DATE
2025-04-11T22:56:16.001000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-12-149date:2012-08-22T00:00:00
db:VULHUBid:VHN-55775date:2012-06-21T00:00:00
db:BIDid:54108date:2015-03-19T08:41:00
db:JVNDBid:JVNDB-2012-002811date:2012-12-14T00:00:00
db:CNNVDid:CNNVD-201206-374date:2012-06-27T00:00:00
db:NVDid:CVE-2012-2494date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:ZDIid:ZDI-12-149date:2012-08-22T00:00:00
db:VULHUBid:VHN-55775date:2012-06-20T00:00:00
db:BIDid:54108date:2012-06-20T00:00:00
db:JVNDBid:JVNDB-2012-002811date:2012-06-22T00:00:00
db:PACKETSTORMid:115785date:2012-08-23T01:56:37
db:CNNVDid:CNNVD-201206-374date:2012-06-21T00:00:00
db:NVDid:CVE-2012-2494date:2012-06-20T20:55:02.543