Sign-up

ID

VAR-201806-0656


CVE

CVE-2018-0373


TITLE

Cisco AnyConnect Secure Mobility Client Vulnerable to cross-site request forgery

Trust: 0.8

sources: JVNDB: JVNDB-2018-006858

DESCRIPTION

A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobility Client for Windows Desktop could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to improper validation of user-supplied data. An attacker could exploit this vulnerability by sending a malicious request to the application. A successful exploit could allow the attacker to cause a DoS condition on the affected system. Cisco Bug IDs: CSCvj47654. Cisco AnyConnect Secure Mobility Client Contains a cross-site request forgery vulnerability. Vendors have confirmed this vulnerability Bug ID CSCvj47654 It is released as.Service operation interruption (DoS) There is a possibility of being put into a state. The vulnerability is caused by the program not correctly validating the data submitted by the user

Trust: 1.98

sources: NVD: CVE-2018-0373 // JVNDB: JVNDB-2018-006858 // BID: 104548 // VULHUB: VHN-118575

AFFECTED PRODUCTS

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:4.5\(2036\)

Trust: 1.6

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:4.5\(4029\)

Trust: 1.6

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:4.6\(362\)

Trust: 1.6

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:4.5\(3040\)

Trust: 1.6

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:4.5\(2033\)

Trust: 1.6

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:4.5\(5030\)

Trust: 1.6

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:4.5\(1044\)

Trust: 1.6

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:4.6\(1098\)

Trust: 1.6

vendor:ciscomodel:anyconnect secure mobility clientscope:eqversion:4.5\(58\)

Trust: 1.6

vendor:ciscomodel:anyconnect secure mobility clientscope: - version: -

Trust: 0.8

vendor:ciscomodel:anyconnect secure mobility client for windowsscope:eqversion:4.0.7

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility client for windowsscope:eqversion:4.6

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility client for windowsscope:eqversion:4.5

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility client for windowsscope:eqversion:4.3

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility client for windowsscope:eqversion:4.2

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility client for windowsscope:eqversion:4.0

Trust: 0.3

vendor:ciscomodel:anyconnect secure mobility client for windowsscope:neversion:4.6.1103

Trust: 0.3

sources: BID: 104548 // JVNDB: JVNDB-2018-006858 // CNNVD: CNNVD-201806-1110 // NVD: CVE-2018-0373

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-0373
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-0373
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201806-1110
value: MEDIUM

Trust: 0.6

VULHUB: VHN-118575
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-0373
severity: MEDIUM
baseScore: 4.9
vectorString: AV:L/AC:L/AU:N/C:N/I:N/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-118575
severity: MEDIUM
baseScore: 4.9
vectorString: AV:L/AC:L/AU:N/C:N/I:N/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-0373
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-118575 // JVNDB: JVNDB-2018-006858 // CNNVD: CNNVD-201806-1110 // NVD: CVE-2018-0373

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.1

problemtype:CWE-352

Trust: 0.8

sources: VULHUB: VHN-118575 // JVNDB: JVNDB-2018-006858 // NVD: CVE-2018-0373

THREAT TYPE

local

Trust: 0.9

sources: BID: 104548 // CNNVD: CNNVD-201806-1110

TYPE

Input Validation Error

Trust: 0.9

sources: BID: 104548 // CNNVD: CNNVD-201806-1110

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-006858

PATCH
title:cisco-sa-20180620-anyconnect-dosurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-anyconnect-dos
Trust: 0.8
title:Cisco AnyConnect Secure Mobility Client for Windows Desktop Enter the fix for the verification vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=81444
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2018-006858 // 
            
            
            
            CNNVD: CNNVD-201806-1110

EXTERNAL IDS
db:NVDid:CVE-2018-0373
Trust: 2.8
db:BIDid:104548
Trust: 2.0
db:SECTRACKid:1041176
Trust: 1.7
db:JVNDBid:JVNDB-2018-006858
Trust: 0.8
db:CNNVDid:CNNVD-201806-1110
Trust: 0.7
db:VULHUBid:VHN-118575
Trust: 0.1
sources:
            
            
            VULHUB: VHN-118575 // 
            
            
            
            BID: 104548 // 
            
            
            
            JVNDB: JVNDB-2018-006858 // 
            
            
            
            CNNVD: CNNVD-201806-1110 // 
            
            
            
            NVD: CVE-2018-0373

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20180620-anyconnect-dos
Trust: 2.0
url:http://www.securityfocus.com/bid/104548
Trust: 1.7
url:http://www.securitytracker.com/id/1041176
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0373
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-0373
Trust: 0.8
url:http://www.cisco.com
Trust: 0.3
sources:
            
            
            VULHUB: VHN-118575 // 
            
            
            
            BID: 104548 // 
            
            
            
            JVNDB: JVNDB-2018-006858 // 
            
            
            
            CNNVD: CNNVD-201806-1110 // 
            
            
            
            NVD: CVE-2018-0373

CREDITS
Gert Doering at OpenVPN
Trust: 0.3
sources:
            
            
            BID: 104548

SOURCES
db:VULHUBid:VHN-118575
db:BIDid:104548
db:JVNDBid:JVNDB-2018-006858
db:CNNVDid:CNNVD-201806-1110
db:NVDid:CVE-2018-0373

LAST UPDATE DATE
2024-11-23T21:53:06.592000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-118575date:2019-10-09T00:00:00
db:BIDid:104548date:2018-06-20T00:00:00
db:JVNDBid:JVNDB-2018-006858date:2018-09-03T00:00:00
db:CNNVDid:CNNVD-201806-1110date:2019-10-17T00:00:00
db:NVDid:CVE-2018-0373date:2024-11-21T03:38:05.420

SOURCES RELEASE DATE
db:VULHUBid:VHN-118575date:2018-06-21T00:00:00
db:BIDid:104548date:2018-06-20T00:00:00
db:JVNDBid:JVNDB-2018-006858date:2018-09-03T00:00:00
db:CNNVDid:CNNVD-201806-1110date:2018-06-22T00:00:00
db:NVDid:CVE-2018-0373date:2018-06-21T11:29:01.227