CVE-2012-2494

Cisco AnyConnect VPN Client Verification Bypass Remote Code Execution Vulnerability

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 and 3.x before 3.0 MR8 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a version downgrade by using (1) ActiveX or (2) Java components to offer signed code that corresponds to an older software release, aka Bug ID CSCtw48681.

La implementación de descargas en VPN en la funcionalidad WebLaunch de Cisco AnyConnect Secure Mobility Client v2.x antes v2.5 MR6 y v3.x antes de v3.0 MR8 no compara la fecha y hora del software que se ofrece con la marca de tiempo del software instalado, lo que permite forzar a una reducción de versión a atacantes remotos mediante el uso de componentes (1) ActiveX o (2) Java para ofrecer código firmado que corresponde a una versión anterior de software. Se trata de un problema también conocido como Bug ID CSCtw48681.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cisco AnyConnect VPN Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists because the VPN AnyConnect helper program does not check the version number of the vpndownloader.exe program it downloads. As such it is possible to forcefully install an older version of the vpndownloader.exe that is vulnerable to previously patched issues.

*Credits: gwslabs.com

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2012-05-07 CVE Reserved
2012-06-20 CVE Published
2024-09-16 CVE Updated
2024-09-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac	2012-06-21

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cisco Search vendor "Cisco"		Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"				2.0 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version "2.0"		-		Affected
Cisco Search vendor "Cisco"		Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"				2.1 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version "2.1"		-		Affected
Cisco Search vendor "Cisco"		Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"				2.2 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version "2.2"		-		Affected
Cisco Search vendor "Cisco"		Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"				2.2.128 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version "2.2.128"		-		Affected
Cisco Search vendor "Cisco"		Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"				2.2.133 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version "2.2.133"		-		Affected
Cisco Search vendor "Cisco"		Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"				2.2.136 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version "2.2.136"		-		Affected
Cisco Search vendor "Cisco"		Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"				2.2.140 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version "2.2.140"		-		Affected
Cisco Search vendor "Cisco"		Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"				2.3 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version "2.3"		-		Affected
Cisco Search vendor "Cisco"		Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"				2.3.185 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version "2.3.185"		-		Affected
Cisco Search vendor "Cisco"		Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"				2.3.254 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version "2.3.254"		-		Affected
Cisco Search vendor "Cisco"		Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"				2.3.2016 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version "2.3.2016"		-		Affected
Cisco Search vendor "Cisco"		Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"				2.4 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version "2.4"		-		Affected
Cisco Search vendor "Cisco"		Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"				2.4.0202 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version "2.4.0202"		-		Affected
Cisco Search vendor "Cisco"		Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"				2.4.1012 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version "2.4.1012"		-		Affected
Cisco Search vendor "Cisco"		Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"				2.5 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version "2.5"		-		Affected
Cisco Search vendor "Cisco"		Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"				3.0 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version "3.0"		-		Affected