Sign-up

ID

VAR-201503-0167


CVE

CVE-2015-0663


TITLE

Cisco AnyConnect Secure Mobility Client Vulnerable to arbitrary file writing

Trust: 0.8

sources: JVNDB: JVNDB-2015-001832

DESCRIPTION

Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier does not properly implement access control for IPC messages, which allows local users to write to arbitrary files via crafted messages, aka Bug ID CSCus79392. An attacker can exploit this issue to write or overwrite arbitrary files with elevated privileges. This may aid in further attacks. This issue is being tracked by Cisco bug ID CSCus79392

Trust: 1.98

sources: NVD: CVE-2015-0663 // JVNDB: JVNDB-2015-001832 // BID: 73122 // VULHUB: VHN-78609

AFFECTED PRODUCTS

vendor:ciscomodel:anyconnect secure mobility clientscope:lteversion:4.0\(.00051\)

Trust: 1.0

vendor:ciscomodel:anyconnect secure mobility clientscope:lteversion:4.0(.00051)

Trust: 0.8

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:4.0\(.00051\)

Trust: 0.6

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:4.0.51

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:4.0.48

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.1.6073

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.1.5187

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.1.5182

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.1.2043

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.9353

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.9266

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.9231

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.5080

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.5075

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.4235

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.3054

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.3050

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.2052

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.1047

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:3.0.629

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.3055

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.3054

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.3051

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.2019

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.2018

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.2017

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.2014

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.2011

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.2010

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.2006

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.217

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.4.1012

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.4.202

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.3.2016

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.3.1003

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.3.254

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.3.185

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.2.140

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.2.136

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.2.133

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.1.148

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.0.343

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.3046

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:2.5.3041

Trust: 0.3

sources: BID: 73122 // JVNDB: JVNDB-2015-001832 // CNNVD: CNNVD-201503-346 // NVD: CVE-2015-0663

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-0663
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-0663
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201503-346
value: MEDIUM

Trust: 0.6

VULHUB: VHN-78609
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-0663
severity: MEDIUM
baseScore: 6.6
vectorString: AV:L/AC:L/AU:N/C:N/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 9.2
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-78609
severity: MEDIUM
baseScore: 6.6
vectorString: AV:L/AC:L/AU:N/C:N/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 9.2
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-78609 // JVNDB: JVNDB-2015-001832 // CNNVD: CNNVD-201503-346 // NVD: CVE-2015-0663

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

sources: VULHUB: VHN-78609 // JVNDB: JVNDB-2015-001832 // NVD: CVE-2015-0663

THREAT TYPE

local

Trust: 0.9

sources: BID: 73122 // CNNVD: CNNVD-201503-346

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201503-346

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-001832

PATCH
title:37863url:http://tools.cisco.com/security/center/viewAlert.x?alertId=37863
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2015-001832

EXTERNAL IDS
db:NVDid:CVE-2015-0663
Trust: 2.8
db:SECTRACKid:1031930
Trust: 1.1
db:JVNDBid:JVNDB-2015-001832
Trust: 0.8
db:CNNVDid:CNNVD-201503-346
Trust: 0.7
db:BIDid:73122
Trust: 0.4
db:VULHUBid:VHN-78609
Trust: 0.1
sources:
            
            
            VULHUB: VHN-78609 // 
            
            
            
            BID: 73122 // 
            
            
            
            JVNDB: JVNDB-2015-001832 // 
            
            
            
            CNNVD: CNNVD-201503-346 // 
            
            
            
            NVD: CVE-2015-0663

REFERENCES
url:http://tools.cisco.com/security/center/viewalert.x?alertid=37863
Trust: 2.0
url:http://www.securitytracker.com/id/1031930
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-0663
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-0663
Trust: 0.8
url:http://www.cisco.com/c/en/us/products/security/anyconnect-secure-mobility-client/index.html
Trust: 0.3
url:http://www.cisco.com/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-78609 // 
            
            
            
            BID: 73122 // 
            
            
            
            JVNDB: JVNDB-2015-001832 // 
            
            
            
            CNNVD: CNNVD-201503-346 // 
            
            
            
            NVD: CVE-2015-0663

CREDITS
Cisco
Trust: 0.3
sources:
            
            
            BID: 73122

SOURCES
db:VULHUBid:VHN-78609
db:BIDid:73122
db:JVNDBid:JVNDB-2015-001832
db:CNNVDid:CNNVD-201503-346
db:NVDid:CVE-2015-0663

LAST UPDATE DATE
2024-11-23T22:38:53.091000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-78609date:2015-10-28T00:00:00
db:BIDid:73122date:2015-03-16T00:00:00
db:JVNDBid:JVNDB-2015-001832date:2015-03-18T00:00:00
db:CNNVDid:CNNVD-201503-346date:2015-03-18T00:00:00
db:NVDid:CVE-2015-0663date:2024-11-21T02:23:29.710

SOURCES RELEASE DATE
db:VULHUBid:VHN-78609date:2015-03-17T00:00:00
db:BIDid:73122date:2015-03-16T00:00:00
db:JVNDBid:JVNDB-2015-001832date:2015-03-18T00:00:00
db:CNNVDid:CNNVD-201503-346date:2015-03-18T00:00:00
db:NVDid:CVE-2015-0663date:2015-03-17T02:01:49.007