CVE-2012-2495
Severity Score
4.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The HostScan downloader implementation in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR8 and Cisco Secure Desktop before 3.6.6020 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a version downgrade by using (1) ActiveX or (2) Java components to offer signed code that corresponds to an older software release, aka Bug ID CSCtx74235.
La implementación de HostScan en Cisco AnyConnect Secure Mobility Client v3.x antes de v3.0 MR8 y Cisco Secure Desktop antes de v3.6.6020 no compara la marca de tiempo del software ofrecido con la marca de tiempo del software instalado, lo que permite forzar una rebaja de la versión a atacantes remotos mediante el uso de componentes (1) ActiveX o (2) Java para ofrecer código firmado que corresponde a una versión anterior del software. Se trata de un prblema también conocido como Bug ID CSCtx74235.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2012-05-07 CVE Reserved
- 2012-06-20 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac | 2012-06-21 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Cisco Search vendor "Cisco" | Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" | 3.0 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version "3.0" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Secure Desktop Search vendor "Cisco" for product "Secure Desktop" | <= 3.5.2008 Search vendor "Cisco" for product "Secure Desktop" and version " <= 3.5.2008" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Secure Desktop Search vendor "Cisco" for product "Secure Desktop" | 3.1 Search vendor "Cisco" for product "Secure Desktop" and version "3.1" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Secure Desktop Search vendor "Cisco" for product "Secure Desktop" | 3.1.1 Search vendor "Cisco" for product "Secure Desktop" and version "3.1.1" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Secure Desktop Search vendor "Cisco" for product "Secure Desktop" | 3.1.1.27 Search vendor "Cisco" for product "Secure Desktop" and version "3.1.1.27" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Secure Desktop Search vendor "Cisco" for product "Secure Desktop" | 3.1.1.33 Search vendor "Cisco" for product "Secure Desktop" and version "3.1.1.33" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Secure Desktop Search vendor "Cisco" for product "Secure Desktop" | 3.1.1.45 Search vendor "Cisco" for product "Secure Desktop" and version "3.1.1.45" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Secure Desktop Search vendor "Cisco" for product "Secure Desktop" | 3.2 Search vendor "Cisco" for product "Secure Desktop" and version "3.2" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Secure Desktop Search vendor "Cisco" for product "Secure Desktop" | 3.2.1 Search vendor "Cisco" for product "Secure Desktop" and version "3.2.1" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Secure Desktop Search vendor "Cisco" for product "Secure Desktop" | 3.3 Search vendor "Cisco" for product "Secure Desktop" and version "3.3" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Secure Desktop Search vendor "Cisco" for product "Secure Desktop" | 3.4 Search vendor "Cisco" for product "Secure Desktop" and version "3.4" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Secure Desktop Search vendor "Cisco" for product "Secure Desktop" | 3.4.1 Search vendor "Cisco" for product "Secure Desktop" and version "3.4.1" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Secure Desktop Search vendor "Cisco" for product "Secure Desktop" | 3.4.2 Search vendor "Cisco" for product "Secure Desktop" and version "3.4.2" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Secure Desktop Search vendor "Cisco" for product "Secure Desktop" | 3.4.2048 Search vendor "Cisco" for product "Secure Desktop" and version "3.4.2048" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Secure Desktop Search vendor "Cisco" for product "Secure Desktop" | 3.5 Search vendor "Cisco" for product "Secure Desktop" and version "3.5" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Secure Desktop Search vendor "Cisco" for product "Secure Desktop" | 3.5.841 Search vendor "Cisco" for product "Secure Desktop" and version "3.5.841" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Secure Desktop Search vendor "Cisco" for product "Secure Desktop" | 3.5.1077 Search vendor "Cisco" for product "Secure Desktop" and version "3.5.1077" | - |
Affected
| ||||||
| Cisco Search vendor "Cisco" | Secure Desktop Search vendor "Cisco" for product "Secure Desktop" | 3.5.2001 Search vendor "Cisco" for product "Secure Desktop" and version "3.5.2001" | - |
Affected
| ||||||