The HostScan downloader implementation in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR8 and Cisco Secure Desktop before 3.6.6020 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a version downgrade by using (1) ActiveX or (2) Java components to offer signed code that corresponds to an older software release, aka Bug ID CSCtx74235.

The remote Windows host is missing one or more kill bits for ActiveX controls that are known to contain vulnerabilities. 

If any of these ActiveX controls are ever installed on the remote host, either now or in the future, they would expose the host to various security issues. 

Note that the affected controls are from a third-party vendor that has asked Microsoft to prevent their controls from being run in Internet Explorer.

The remote host has a version of Cisco AnyConnect < 2.5 MR6 / 3.0 MR8.
Such versions are potentially affected by multiple vulnerabilities :

  - The WebLaunch VPN downloader implementation does not     properly validate binaries that are received, which can     allow remote attackers to execute arbitrary code via     ActiveX of Java components. (CVE-2012-2493).

  - The WebLaunch VPN downloader implementation does not     compare timestamps of offered software to install with     currently installed software, which may allow remote     attackers to downgrade the software via ActiveX of Java     components. (CVE-2012-2494, CVE-2012-2495).

The remote host has a version of Cisco AnyConnect < 3.0 MR8.
Such versions are affected by the following vulnerabilities :

  - The HostScan VPN downloader implementation does not     compare timestamps of offered software to install     with currently installed software, which may allow     remote attackers to downgrade the software via ActiveX     or Java components. (CVE-2012-2495)

  - Man-in-the-middle attacks are possible even when the     ASA is configured with a legitimate certificate.
    (CVE-2012-2498)

  - No certificate name checking is performed when using     IPsec as the tunnel protocol, which could result in     man-in-the-middle attacks. (CVE-2012-2499)

  - Certificate names are not verified during WebLaunch     of IPsec, which could result in man-in-the-middle     attacks. (CVE-2012-2500)

ID	Name	Product	Family	Severity
62045	MS 2736233: Update Rollup for ActiveX Kill Bits (2736233)	Nessus	Windows	high
59823	MacOSX Cisco AnyConnect Secure Mobility Client Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
59821	Cisco AnyConnect Secure Mobility Client 3.0 < 3.0 MR8 Multiple Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2012-2495

high

Tenable Plugins

high

high

medium