Vulnerabilities > CVE-2011-2040 - Improper Input Validation vulnerability in Cisco Anyconnect Secure Mobility Client
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.5.3041, and 3.0.x before 3.0.629, on Linux and Mac OS X downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a Java applet, aka Bug ID CSCsy05934.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Server Side Include (SSI) Injection An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
- Cross Zone Scripting An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
- Cross Site Scripting through Log Files An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
- Command Line Execution through SQL Injection An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
Nessus
| NASL family | MacOS X Local Security Checks |
| NASL id | MACOSX_CISCO_ANYCONNECT_3_0_629.NASL |
| description | The remote host has a version of Cisco AnyConnect 2.x or 3.x prior to 3.0(629) and is, therefore, affected by the following vulnerabilities : - When the client is obtained from the VPN headend using a web browser, a helper application performs the download and installation. This helper application does not verify the authenticity of the downloaded installer, which could allow an attacker to send malicious code to the user instead. Note 2.x versions prior to 2.5.3041 are affected by this vulnerability. (CVE-2011-2040) - When the VPNAPI COM module calls the ATL framework, certain input data are not properly validated. This could allow a buffer overflow, which could lead to arbitrary code execution. (CVE-2013-5559) |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 71465 |
| published | 2013-12-16 |
| reporter | This script is Copyright (C) 2013-2018 Tenable Network Security, Inc. |
| source | https://www.tenable.com/plugins/nessus/71465 |
| title | Mac OS X : Cisco AnyConnect Secure Mobility Client 2.x / 3.x < 3.0(629) Multiple Vulnerabilities |
| code | |
Seebug
| bulletinFamily | exploit |
| description | Bugtraq ID: 48081,48087 CVE ID：CVE-2011-2039 CVE-2011-2040 CVE-2011-2041 Cisco AnyConnect Secure Mobility Client是思科公司提供的远端存取解决方案，是思科的下一代VPN客户端。 Cisco AnyConnect安全移动客户端存在如下漏洞： -任意程序执行漏洞(CVE-2011-2040) 当从VPN前端部署Cisco AnyConnect安全移动客户端时，会使用WEB浏览器向VPN前端初始化一个SSL连接。在用户登录后，浏览器会显示门户窗口，当用户点击"Start AnyConnect连接时，进程会开始下载Cisco AnyConnect安全移动客户端。此行为导致浏览器首先下载"helper"应用程序，用于辅助下载和执行实际的Cisco AnyConnect安全移动客户端。helper应用程序是一个Linux和MacOS X平台上的Java Applet或者windows平台上的Java Applet或是一个浏览器上的ActiveX插件。下载的Helper程序以WEB浏览器中初始站点上下文执行。然后Helper程序会从VPN前端下载程序并执行。 当从VPN前端配置客户端时Helper应用程序无法正确校验下载的Cisco AnyConnect安全移动客户端，攻击者可以创建恶意看起来像正常VPN WEB登录页面的WEB页，使用社会工程欺骗或其他漏洞诱使用户访问，允许攻击者提供任意可执行程序让helper应用程序下载并执行。 -本地特权提升(CVE-2011-2041) 在启用了”Start Before Logon“及在windows登录屏幕中能与Cisco AnyConnect安全移动客户端图形用户接口交互的系统上，非特权用户可以提升特权为LocalSystem。此漏洞只影响Windows平台，因为SBL不支持Linux和MacOS X客户端。 Cisco AnyConnect VPN Client 2.4.202 Cisco AnyConnect Secure Mobility Client 3.0 Cisco AnyConnect Secure Mobility Client 2.5 Cisco AnyConnect Secure Mobility Client 2.3 厂商解决方案 用户可参考如下供应商提供的安全公告获得补丁信息： http://www.cisco.com/en/US/products/products_security_advisory09186a0080b80123.shtml |
| id | SSV:20604 |
| last seen | 2017-11-19 |
| modified | 2011-06-04 |
| published | 2011-06-04 |
| reporter | Root |
| title | Cisco AnyConnect Secure Mobility Client任意代码执行及本地特权提升漏洞 |