cnvd - cnvd-2021-35618

cnvd-2021-35618

Vulnerability from cnvd

Title: Cisco AnyConnect Secure Mobility Client输入验证错误漏洞

Description:

Cisco AnyConnect Secure Mobility Client for Windows是美国思科（Cisco）公司的一款基于Windows平台的可通过任何设备安全访问网络和应用的安全移动客户端。

Cisco AnyConnect Secure Mobility Client 4.10.00093之前版本的进程间通信（IPC）通道存在输入验证错误漏洞。该漏洞源于程序未对用户输入进行正确验证。经过身份认证的本地攻击者可通过向AnyConnect进程发送特制的IPC消息利用该漏洞覆盖受影响设备上的VPN配置文件。

Severity: 低

Patch Name: Cisco AnyConnect Secure Mobility Client输入验证错误漏洞的补丁

Patch Description:

Cisco AnyConnect Secure Mobility Client for Windows是美国思科（Cisco）公司的一款基于Windows平台的可通过任何设备安全访问网络和应用的安全移动客户端。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-profile-AggMUCDg

Reference: https://www.auscert.org.au/bulletins/ESB-2021.1530

Impacted products

Name
Cisco AnyConnect Secure Mobility Client <4.10.00093

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-1519"
    }
  },
  "description": "Cisco AnyConnect Secure Mobility Client for Windows\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u57fa\u4e8eWindows\u5e73\u53f0\u7684\u53ef\u901a\u8fc7\u4efb\u4f55\u8bbe\u5907\u5b89\u5168\u8bbf\u95ee\u7f51\u7edc\u548c\u5e94\u7528\u7684\u5b89\u5168\u79fb\u52a8\u5ba2\u6237\u7aef\u3002\n \nCisco AnyConnect Secure Mobility Client 4.10.00093\u4e4b\u524d\u7248\u672c\u7684\u8fdb\u7a0b\u95f4\u901a\u4fe1\uff08IPC\uff09\u901a\u9053\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u5bf9\u7528\u6237\u8f93\u5165\u8fdb\u884c\u6b63\u786e\u9a8c\u8bc1\u3002\u7ecf\u8fc7\u8eab\u4efd\u8ba4\u8bc1\u7684\u672c\u5730\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5411AnyConnect\u8fdb\u7a0b\u53d1\u9001\u7279\u5236\u7684IPC\u6d88\u606f\u5229\u7528\u8be5\u6f0f\u6d1e\u8986\u76d6\u53d7\u5f71\u54cd\u8bbe\u5907\u4e0a\u7684VPN\u914d\u7f6e\u6587\u4ef6\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-profile-AggMUCDg",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-35618",
  "openTime": "2021-05-19",
  "patchDescription": "Cisco AnyConnect Secure Mobility Client for Windows\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u57fa\u4e8eWindows\u5e73\u53f0\u7684\u53ef\u901a\u8fc7\u4efb\u4f55\u8bbe\u5907\u5b89\u5168\u8bbf\u95ee\u7f51\u7edc\u548c\u5e94\u7528\u7684\u5b89\u5168\u79fb\u52a8\u5ba2\u6237\u7aef\u3002\r\n \r\nCisco AnyConnect Secure Mobility Client 4.10.00093\u4e4b\u524d\u7248\u672c\u7684\u8fdb\u7a0b\u95f4\u901a\u4fe1\uff08IPC\uff09\u901a\u9053\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u5bf9\u7528\u6237\u8f93\u5165\u8fdb\u884c\u6b63\u786e\u9a8c\u8bc1\u3002\u7ecf\u8fc7\u8eab\u4efd\u8ba4\u8bc1\u7684\u672c\u5730\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5411AnyConnect\u8fdb\u7a0b\u53d1\u9001\u7279\u5236\u7684IPC\u6d88\u606f\u5229\u7528\u8be5\u6f0f\u6d1e\u8986\u76d6\u53d7\u5f71\u54cd\u8bbe\u5907\u4e0a\u7684VPN\u914d\u7f6e\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco AnyConnect Secure Mobility Client\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Cisco AnyConnect Secure Mobility Client \u003c4.10.00093"
  },
  "referenceLink": "https://www.auscert.org.au/bulletins/ESB-2021.1530",
  "serverity": "\u4f4e",
  "submitTime": "2021-05-07",
  "title": "Cisco AnyConnect Secure Mobility Client\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e"
}

CVE-2021-1519 (GCVE-0-2021-1519)

Vulnerability from cvelistv5

Published

2021-05-06 12:51

Modified

2024-11-08 23:16

Severity ?

4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-20

Summary

A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to overwrite VPN profiles on an affected device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to modify VPN profile files. To exploit this vulnerability, the attacker must have valid credentials on the affected system.

References

▼	URL	Tags
	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-profile-AggMUCDg	vendor-advisory, x_refsource_CISCO

Impacted products

	Vendor	Product	Version
	Cisco	Cisco AnyConnect Secure Mobility Client	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:11:17.692Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20210505 Cisco AnyConnect Secure Mobility Client Profile Modification Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-profile-AggMUCDg"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-1519",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-08T20:43:11.974963Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-08T23:16:30.027Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco AnyConnect Secure Mobility Client",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2021-05-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to overwrite VPN profiles on an affected device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to modify VPN profile files. To exploit this vulnerability, the attacker must have valid credentials on the affected system."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept exploit code is available for the vulnerability described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-06T12:51:11",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20210505 Cisco AnyConnect Secure Mobility Client Profile Modification Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-profile-AggMUCDg"
        }
      ],
      "source": {
        "advisory": "cisco-sa-anyconnect-profile-AggMUCDg",
        "defect": [
          [
            "CSCvx86389"
          ]
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco AnyConnect Secure Mobility Client Profile Modification Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2021-05-05T16:00:00",
          "ID": "CVE-2021-1519",
          "STATE": "PUBLIC",
          "TITLE": "Cisco AnyConnect Secure Mobility Client Profile Modification Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco AnyConnect Secure Mobility Client",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to overwrite VPN profiles on an affected device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to modify VPN profile files. To exploit this vulnerability, the attacker must have valid credentials on the affected system."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept exploit code is available for the vulnerability described in this advisory."
          }
        ],
        "impact": {
          "cvss": {
            "baseScore": "4.7",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20210505 Cisco AnyConnect Secure Mobility Client Profile Modification Vulnerability",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-profile-AggMUCDg"
            }
          ]
        },
        "source": {
          "advisory": "cisco-sa-anyconnect-profile-AggMUCDg",
          "defect": [
            [
              "CSCvx86389"
            ]
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2021-1519",
    "datePublished": "2021-05-06T12:51:11.826380Z",
    "dateReserved": "2020-11-13T00:00:00",
    "dateUpdated": "2024-11-08T23:16:30.027Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted