Detections
Analytics

Cisco AnyConnect Secure Mobility Client 4.0(2049) Unspecified Out-of-bounds Read Local DoS

medium Log Correlation Engine Plugin ID 801957

Synopsis

Cisco AnyConnect Secure Mobility Client contains a vulnerability that could allow a local attacker to cause a denial of service condition.

Description

A vulnerability in the kernel extension for Mac OS X of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to cause a denial of service (DoS) condition.

The vulnerability is due to insufficient bounds checking. An attacker could exploit this vulnerability by crafting a piece of contiguous data in memory that is read by the client software. An exploit could allow the attacker to cause an OS X kernel panic.

Solution

It has been reported that this issue has been fixed, although Cisco has not published any details. They have advised users seeking fixes to contact the normal support channels to do so.

See Also

http://www.cisco.com/

https://tools.cisco.com/bugsearch/bug/CSCut12255

http://tools.cisco.com/security/center/viewAlert.x?alertId=40176

Plugin Details

Severity: Medium

ID: 801957

Family: Generic

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 4

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C

Vulnerability Information

Patch Publication Date: 7/28/2015

Vulnerability Publication Date: 7/28/2015

Reference Information

CVE: CVE-2015-4290