Sign-up

ID

VAR-201503-0168


CVE

CVE-2015-0664


TITLE

Cisco AnyConnect Secure Mobility Client of IPC Vulnerability written to arbitrary user space memory area in channel

Trust: 0.8

sources: JVNDB: JVNDB-2015-001857

DESCRIPTION

The IPC channel in Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to write to arbitrary userspace memory locations, and consequently gain privileges, via crafted messages, aka Bug ID CSCus79195. Attackers can exploit this vulnerability to execute arbitrary code in the context of the user running the vulnerable application or to cause a denial-of-service condition. This issue is tracked by Cisco Bug ID CSCus79195

Trust: 1.98

sources: NVD: CVE-2015-0664 // JVNDB: JVNDB-2015-001857 // BID: 73120 // VULHUB: VHN-78610

AFFECTED PRODUCTS

vendor:ciscomodel:anyconnect secure mobility clientscope:lteversion:4.0\(.00051\)

Trust: 1.0

vendor:ciscomodel:anyconnect secure mobility clientscope:lteversion:4.0(.00051)

Trust: 0.8

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:4.0\(.00051\)

Trust: 0.6

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:4.0.51

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:4.0.48

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.1.6073

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.1.5187

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.1.5182

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.1.2043

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.9353

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.9266

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.9231

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.5080

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.5075

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.4235

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.3054

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.3050

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.2052

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.1047

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.629

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.3055

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.3054

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.3051

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.2019

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.2018

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.2017

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.2014

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.2011

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.2010

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.2006

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.217

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.4.1012

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.4.202

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.3.2016

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.3.1003

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.3.254

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.3.185

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.2.140

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.2.136

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.2.133

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.1.148

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.0.343

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.1

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.3046

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.3041

Trust: 0.3

sources: BID: 73120 // JVNDB: JVNDB-2015-001857 // CNNVD: CNNVD-201503-386 // NVD: CVE-2015-0664

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-0664
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-0664
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201503-386
value: MEDIUM

Trust: 0.6

VULHUB: VHN-78610
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-0664
severity: MEDIUM
baseScore: 4.3
vectorString: AV:L/AC:L/AU:S/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.1
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-78610
severity: MEDIUM
baseScore: 4.3
vectorString: AV:L/AC:L/AU:S/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.1
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-78610 // JVNDB: JVNDB-2015-001857 // CNNVD: CNNVD-201503-386 // NVD: CVE-2015-0664

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-78610 // JVNDB: JVNDB-2015-001857 // NVD: CVE-2015-0664

THREAT TYPE

local

Trust: 0.9

sources: BID: 73120 // CNNVD: CNNVD-201503-386

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201503-386

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-001857

PATCH
title:37861url:http://tools.cisco.com/security/center/viewAlert.x?alertId=37861
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2015-001857

EXTERNAL IDS
db:NVDid:CVE-2015-0664
Trust: 2.8
db:SECTRACKid:1031932
Trust: 1.1
db:JVNDBid:JVNDB-2015-001857
Trust: 0.8
db:CNNVDid:CNNVD-201503-386
Trust: 0.7
db:BIDid:73120
Trust: 0.4
db:VULHUBid:VHN-78610
Trust: 0.1
sources:
            
            
            VULHUB: VHN-78610 // 
            
            
            
            BID: 73120 // 
            
            
            
            JVNDB: JVNDB-2015-001857 // 
            
            
            
            CNNVD: CNNVD-201503-386 // 
            
            
            
            NVD: CVE-2015-0664

REFERENCES
url:http://tools.cisco.com/security/center/viewalert.x?alertid=37861
Trust: 2.0
url:http://www.securitytracker.com/id/1031932
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-0664
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-0664
Trust: 0.8
url:http://www.cisco.com/c/en/us/products/security/anyconnect-secure-mobility-client/index.html
Trust: 0.3
url:http://www.cisco.com
Trust: 0.3
sources:
            
            
            VULHUB: VHN-78610 // 
            
            
            
            BID: 73120 // 
            
            
            
            JVNDB: JVNDB-2015-001857 // 
            
            
            
            CNNVD: CNNVD-201503-386 // 
            
            
            
            NVD: CVE-2015-0664

CREDITS
Cisco
Trust: 0.3
sources:
            
            
            BID: 73120

SOURCES
db:VULHUBid:VHN-78610
db:BIDid:73120
db:JVNDBid:JVNDB-2015-001857
db:CNNVDid:CNNVD-201503-386
db:NVDid:CVE-2015-0664

LAST UPDATE DATE
2025-04-13T23:23:46.175000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-78610date:2015-09-10T00:00:00
db:BIDid:73120date:2015-03-14T00:00:00
db:JVNDBid:JVNDB-2015-001857date:2015-03-20T00:00:00
db:CNNVDid:CNNVD-201503-386date:2015-03-19T00:00:00
db:NVDid:CVE-2015-0664date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULHUBid:VHN-78610date:2015-03-18T00:00:00
db:BIDid:73120date:2015-03-14T00:00:00
db:JVNDBid:JVNDB-2015-001857date:2015-03-20T00:00:00
db:CNNVDid:CNNVD-201503-386date:2015-03-19T00:00:00
db:NVDid:CVE-2015-0664date:2015-03-18T23:59:00.067