Published: 12/10/2015 Updated: 12/12/2016

CVSS v2 Base Score: 6.6 | Impact Score: 9.2 | Exploitability Score: 3.9

VMScore: 587

Vector: AV:L/AC:L/Au:N/C:N/I:C/A:C

The IPC channel in Cisco AnyConnect Secure Mobility Client 2.0.0343 up to and including 4.1(8) allows local users to bypass intended access restrictions and move arbitrary files by leveraging the lack of source-path validation, aka Bug ID CSCuv48563.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cisco anyconnect secure mobility client 2.3.0254
cisco anyconnect secure mobility client 2.3.2016
cisco anyconnect secure mobility client 2.5.2011
cisco anyconnect secure mobility client 2.5.2017
cisco anyconnect secure mobility client 2.5.3051
cisco anyconnect secure mobility client 2.5.3055
cisco anyconnect secure mobility client 3.0.4235
cisco anyconnect secure mobility client 3.0.5080
cisco anyconnect secure mobility client 3.1.05187
cisco anyconnect secure mobility client 3.1.07021
cisco anyconnect secure mobility client 4.0\\(64\\)
cisco anyconnect secure mobility client 4.0\\(2049\\)
cisco anyconnect secure mobility client 2.4.1012
cisco anyconnect secure mobility client 2.5_base
cisco anyconnect secure mobility client 2.5.0217
cisco anyconnect secure mobility client 2.5.2006
cisco anyconnect secure mobility client 3.0.0629
cisco anyconnect secure mobility client 3.0.1047
cisco anyconnect secure mobility client 3.0.2052
cisco anyconnect secure mobility client 3.0.3050
cisco anyconnect secure mobility client 3.1\\(60\\)
cisco anyconnect secure mobility client 4.0.0
cisco anyconnect secure mobility client 4.0.00048
cisco anyconnect secure mobility client 4.0.00051
cisco anyconnect secure mobility client 2.1.0148
cisco anyconnect secure mobility client 2.2.0133
cisco anyconnect secure mobility client 2.2.0136
cisco anyconnect secure mobility client 2.2.0140
cisco anyconnect secure mobility client 2.5.2018
cisco anyconnect secure mobility client 2.5.2019
cisco anyconnect secure mobility client 2.5.3041
cisco anyconnect secure mobility client 2.5.3046
cisco anyconnect secure mobility client 3.0.09266
cisco anyconnect secure mobility client 3.0.09353
cisco anyconnect secure mobility client 3.1.0
cisco anyconnect secure mobility client 3.1.02043
cisco anyconnect secure mobility client 4.1\\(8\\)
cisco anyconnect secure mobility client 2.0.0343
cisco anyconnect secure mobility client 2.3.0185
cisco anyconnect secure mobility client 2.3.1003
cisco anyconnect secure mobility client 2.4.0202
cisco anyconnect secure mobility client 2.5.2010
cisco anyconnect secure mobility client 2.5.2014
cisco anyconnect secure mobility client 2.5.3054
cisco anyconnect secure mobility client 3.0.0
cisco anyconnect secure mobility client 3.0.3054
cisco anyconnect secure mobility client 3.0.5075
cisco anyconnect secure mobility client 3.0.09231
cisco anyconnect secure mobility client 3.1.05182
cisco anyconnect secure mobility client 3.1.06073
cisco anyconnect secure mobility client 4.0\\(48\\)
cisco anyconnect secure mobility client 4.1.0

A vulnerability in interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to move arbitrary files with elevated privileges The vulnerability is due to missing source path validation in certain IPC commands An attacker could exploit this vulnerability by sending crafted IP ...

CWE-264 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151008-asmc http://www.securitytracker.com/id/1033785 https://nvd.nist.gov http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151008-asmc

CVE-2015-6322

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect