Cisco AnyConnect Multiple Vulnerabilities Advisory (CVE-2012-2493/2494/2495)

Critical Vulnerability Information Vulnerability Name: Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client Severity: Critical Vulnerability IDs: cisco-sa-20120620-ac CVE-2012-2493 CVE-2012-2494 CVE-2012-2495 Affected Products: Cisco AnyConnect Secure Mobility Client Cisco Secure Desktop Vulnerability Description: Cisco AnyConnect Secure Mobility Client and Cisco Secure Desktop contain multiple arbitrary code execution vulnerabilities and downgrade vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary code or force a downgrade to an older software version. Affected Versions: Cisco AnyConnect Secure Mobility Client: - Microsoft Windows: 2.x releases prior to 2.5 MR6 (2.5.6005) - Linux, Apple: 3.0.x releases prior to 3.0 MR8 (3.0.08057) Cisco Secure Desktop: - Windows: versions after 3.0.08057 - Linux, Apple: versions after 3.6.6020 Remediation and Mitigation: Upgrade to the latest version of the affected software. Use the JAR blacklist feature to prevent exploitation of vulnerable Java applets. Follow Cisco’s security advisory and apply relevant software updates. Impact Details: The vulnerabilities can be exploited by remote attackers to execute arbitrary code on affected systems. The vulnerabilities also allow downloading and installing older versions of Cisco AnyConnect Secure Mobility Client software, potentially leading to additional security risks. URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac

Goal Reached Thanks to every supporter — we hit 100%!

Cisco AnyConnect Multiple Vulnerabilities Advisory (CVE-2012-2493/2494/2495)