Cisco has confirmed vulnerablilty in Cisco AnyConnect secure mobility client, patch released
Late Wednesday Cisco released software updates for several versions of the Cisco AnyConnect line of VPN products, also covered under a second notice is the Cisco Application Control Engine appliance. A compromised system could allow an intruder to load malicious software on the system or access network resources that should be secure. The exploits are based on Active-X and Java code that can be embedded in web content.
If you are running any of the AnyConnect clients or Cisco ACE appliances be sure to update them because this is actively being used to gain access to systems. Below is a chart of affected clients courtesy of Cisco System:
| Vulnerability | Platform | Affected Versions |
|---|---|---|
| Cisco AnyConnect Secure Mobility Client VPN Downloader Arbitrary Code Execution Vulnerability |
Microsoft Windows |
|
| Linux, Apple MacOS |
|
|
| Cisco AnyConnect Secure Mobility Client VPN Downloader Software Downgrade Vulnerability |
Microsoft Windows |
|
| Linux, Apple MacOS X |
|
|
| Cisco AnyConnect Secure Mobility Client and Cisco Secure Desktop HostScan Downloader Software Downgrade Vulnerability |
Microsoft Windows |
|
| Linux, Apple MacOS X |
|
|
| Cisco AnyConnect Secure Mobility Client 64-bit Java VPN Downloader Arbitrary Code Execution Vulnerability |
Linux 64-bit |
|
Full details and patch information on the AnyConnect client issue can be found here:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac
And the Cisco ACE appliance information can be found here:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ace
Comments
Tell me what you're thinking...
