20120620 Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client

The remote Windows host is missing one or more kill bits for ActiveX controls that are known to contain vulnerabilities. 

If any of these ActiveX controls are ever installed on the remote host, either now or in the future, they would expose the host to various security issues. 

Note that the affected controls are from a third-party vendor that has asked Microsoft to prevent their controls from being run in Internet Explorer.

The remote host has a version of Cisco AnyConnect < 2.5 MR6 / 3.0 MR8.
Such versions are potentially affected by multiple vulnerabilities :

  - The WebLaunch VPN downloader implementation does not     properly validate binaries that are received, which can     allow remote attackers to execute arbitrary code via     ActiveX of Java components. (CVE-2012-2493).

  - The WebLaunch VPN downloader implementation does not     compare timestamps of offered software to install with     currently installed software, which may allow remote     attackers to downgrade the software via ActiveX of Java     components. (CVE-2012-2494, CVE-2012-2495).

The remote host has a version of Cisco AnyConnect < 3.0 MR8.
Such versions are affected by the following vulnerabilities :

  - The HostScan VPN downloader implementation does not     compare timestamps of offered software to install     with currently installed software, which may allow     remote attackers to downgrade the software via ActiveX     or Java components. (CVE-2012-2495)

  - Man-in-the-middle attacks are possible even when the     ASA is configured with a legitimate certificate.
    (CVE-2012-2498)

  - No certificate name checking is performed when using     IPsec as the tunnel protocol, which could result in     man-in-the-middle attacks. (CVE-2012-2499)

  - Certificate names are not verified during WebLaunch     of IPsec, which could result in man-in-the-middle     attacks. (CVE-2012-2500)

ID	Name	Product	Family	Severity
62045	MS 2736233: Update Rollup for ActiveX Kill Bits (2736233)	Nessus	Windows	high
59823	MacOSX Cisco AnyConnect Secure Mobility Client Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
59821	Cisco AnyConnect Secure Mobility Client 3.0 < 3.0 MR8 Multiple Vulnerabilities	Nessus	Windows	medium

CVE-2012-2495

medium

Tenable Plugins

high

high

medium