CVE - CVE-2011-2039

CVE-ID
CVE-2011-2039	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows Mobile, downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a certain ActiveX control in vpnweb.ocx, aka Bug ID CSCsy00904.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CERT-VN:VU#490097 URL:http://www.kb.cert.org/vuls/id/490097 CISCO:20110601 Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client URL:http://www.cisco.com/en/US/products/products_security_advisory09186a0080b80123.shtml IDEFENSE:20110601 Cisco AnyConnect VPN Client Arbitrary Program Execution Vulnerability URL:http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=909 OSVDB:72714 URL:~~http://osvdb.org/72714~~ (Obsolete source) SECTRACK:1025591 URL:http://www.securitytracker.com/id?1025591 SREASON:8272 URL:http://securityreason.com/securityalert/8272 XF:cisco-asmc-helper-code-execution(67739) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/67739
Assigning CNA
Cisco Systems, Inc.
Date Record Created
20110510	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20110510)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)