CVE-2015-0761
HighSummary
Cisco AnyConnect Secure Mobility Client before 3.1(8009) and 4.x before 4.0(2052) on Linux does not properly implement unspecified internal functions, allowing local users to obtain root privileges via crafted vpnagent options.
Risk Assessment
This vulnerability poses a risk to organizations as local users can gain unauthorized access to the system with administrator privileges.
Recommendation
It is recommended to update the Cisco AnyConnect client to the latest version to mitigate the risk associated with this vulnerability.
Other vulnerabilities in Cisco AnyConnect Secure Mobility Client
See all- CVE-2016-6369High
Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, allowing local users to gain privileges via a crafted INF file.
- CVE-2015-0662High
Cisco AnyConnect Secure Mobility Client version 4.0(.00051) and earlier allows local users to gain privileges via crafted IPC messages that trigger the use of root privileges for software-package installation.
- CVE-2020-3433HighActively exploited
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. The vulnerability is due to insufficient validation of resources loaded by the application. An attacker could send a crafted IPC message to the AnyConnect process, leading to arbitrary code execution with SYSTEM privileges.
- CVE-2020-3153MediumActively exploited
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to incorrect handling of directory paths.
Original NVD description (English source)
Cisco AnyConnect Secure Mobility Client before 3.1(8009) and 4.x before 4.0(2052) on Linux does not properly implement unspecified internal functions, which allows local users to obtain root privileges via crafted vpnagent options, aka Bug ID CSCus86790.