ID
VAR-202102-0544
CVE
CVE-2021-1366
TITLE
Windows for Cisco AnyConnect Secure Mobility Client Digital Signature Verification Vulnerability in
Trust: 0.8
DESCRIPTION
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the AnyConnect client. This vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker needs valid credentials on the Windows system. Windows for Cisco AnyConnect Secure Mobility Client Exists in a digital signature validation vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. There is a security vulnerability in Cisco AnyConnect Secure Mobility Client. There is no information about this vulnerability at present. Please keep an eye on CNNVD or vendor announcements
Trust: 1.8
AFFECTED PRODUCTS
| vendor: | cisco | model: | anyconnect secure mobility client | scope: | lt | version: | 4.9.05042 | Trust: 1.0 |
| vendor: | シスコシステムズ | model: | cisco anyconnect secure mobility client | scope: | eq | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-427 | Trust: 1.1 |
| problemtype: | CWE-347 | Trust: 1.0 |
| problemtype: | Improper verification of digital signatures (CWE-347) [NVD Evaluation ] | Trust: 0.8 |
THREAT TYPE
local
Trust: 0.6
TYPE
code problem
Trust: 0.6
PATCH
| title: | cisco-sa-anyconnect-dll-hijac-JrcTOQMC | url: | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-hijac-JrcTOQMC | Trust: 0.8 |
| title: | Cisco Cisco AnyConnect Secure Mobility Client Repair measures for data forgery problem vulnerabilities | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=142450 | Trust: 0.6 |
| title: | Cisco: Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability | url: | https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-anyconnect-dll-hijac-JrcTOQMC | Trust: 0.1 |
| title: | CVE-2021-1366 References | url: | https://github.com/koztkozt/CVE-2021-1366 | Trust: 0.1 |
| title: | writeups about analysis CVEs and Exploits on the Windows 2022 2021 2019 2018 2015 | url: | https://github.com/Creamy-Chicken-Soup/writeups-about-analysis-CVEs-and-Exploits-on-the-Windows | Trust: 0.1 |
| title: | 主流供应商的一些攻击性漏洞汇总 | url: | https://github.com/r0eXpeR/supplier | Trust: 0.1 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2021-1366 | Trust: 2.6 |
| db: | JVNDB | id: | JVNDB-2021-003803 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202102-1301 | Trust: 0.7 |
| db: | AUSCERT | id: | ESB-2021.0594 | Trust: 0.6 |
| db: | VULHUB | id: | VHN-374420 | Trust: 0.1 |
| db: | VULMON | id: | CVE-2021-1366 | Trust: 0.1 |
REFERENCES
| url: | https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-anyconnect-dll-hijac-jrctoqmc | Trust: 1.9 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2021-1366 | Trust: 1.4 |
| url: | https://vigilance.fr/vulnerability/cisco-anyconnect-secure-mobility-client-for-windows-executing-dll-code-via-vpn-posture-module-34606 | Trust: 0.6 |
| url: | https://www.auscert.org.au/bulletins/esb-2021.0594 | Trust: 0.6 |
| url: | https://cwe.mitre.org/data/definitions/427.html | Trust: 0.1 |
| url: | https://github.com/koztkozt/cve-2021-1366 | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
SOURCES
| db: | VULHUB | id: | VHN-374420 |
| db: | VULMON | id: | CVE-2021-1366 |
| db: | JVNDB | id: | JVNDB-2021-003803 |
| db: | CNNVD | id: | CNNVD-202102-1301 |
| db: | NVD | id: | CVE-2021-1366 |
LAST UPDATE DATE
2024-11-23T22:25:11.731000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-374420 | date: | 2022-08-05T00:00:00 |
| db: | VULMON | id: | CVE-2021-1366 | date: | 2023-11-07T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-003803 | date: | 2021-11-04T09:16:00 |
| db: | CNNVD | id: | CNNVD-202102-1301 | date: | 2022-08-08T00:00:00 |
| db: | NVD | id: | CVE-2021-1366 | date: | 2024-11-21T05:44:11.470 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-374420 | date: | 2021-02-17T00:00:00 |
| db: | VULMON | id: | CVE-2021-1366 | date: | 2021-02-17T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-003803 | date: | 2021-11-04T00:00:00 |
| db: | CNNVD | id: | CNNVD-202102-1301 | date: | 2021-02-17T00:00:00 |
| db: | NVD | id: | CVE-2021-1366 | date: | 2021-02-17T17:15:12.643 |