CVE-2021-34788

Cisco AnyConnect Secure Mobility Client for Linux and Mac OS with VPN Posture (HostScan) Module Shared Library Hijacking Vulnerability

Severity Score

7.0

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability in the shared library loading mechanism of Cisco AnyConnect Secure Mobility Client for Linux and Mac OS could allow an authenticated, local attacker to perform a shared library hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the AnyConnect client. This vulnerability is due to a race condition in the signature verification process for shared library files that are loaded on an affected device. An attacker could exploit this vulnerability by sending a series of crafted interprocess communication (IPC) messages to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected device with root privileges. To exploit this vulnerability, the attacker must have a valid account on the system.

Una vulnerabilidad en el mecanismo de carga de la biblioteca compartida de Cisco AnyConnect Secure Mobility Client para Linux y Mac OS podría permitir a un atacante local autenticado llevar a cabo un ataque de secuestro de la biblioteca compartida en un dispositivo afectado si el módulo VPN Posture (HostScan) está instalado en el cliente AnyConnect. Esta vulnerabilidad es debido a una condición de carrera en el proceso de verificación de firmas para los archivos de bibliotecas compartidas que son cargadas en un dispositivo afectado. Un atacante podría explotar esta vulnerabilidad mediante el envío de una serie de mensajes de comunicación interproceso (IPC) diseñados al proceso AnyConnect. Una explotación con éxito podría permitir al atacante ejecutar código arbitrario en el dispositivo afectado con privilegios root. Para explotar esta vulnerabilidad, el atacante debe tener una cuenta válida en el sistema

*Credits: N/A

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-06-15 CVE Reserved
2021-10-06 CVE Published
2023-03-08 EPSS Updated
2024-09-16 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-lib-hija-cAFB7x4q	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cisco Search vendor "Cisco"	Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"	< 4.10.03104 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version " < 4.10.03104"	-	Affected	in	Apple Search vendor "Apple"	Macos Search vendor "Apple" for product "Macos"	-	-	Safe
Cisco Search vendor "Cisco"	Anyconnect Secure Mobility Client Search vendor "Cisco" for product "Anyconnect Secure Mobility Client"	< 4.10.03104 Search vendor "Cisco" for product "Anyconnect Secure Mobility Client" and version " < 4.10.03104"	-	Affected	in	Linux Search vendor "Linux"	Linux Kernel Search vendor "Linux" for product "Linux Kernel"	-	-	Safe