Mac OS X : Cisco AnyConnect Secure Mobility Client 2.x / 3.x < 3.0(629) Multiple Vulnerabilities
High Nessus Plugin ID 71465
The remote host has software installed that is affected by multiple vulnerabilities.
The remote host has a version of Cisco AnyConnect 2.x or 3.x prior to 3.0(629) and is, therefore, affected by the following vulnerabilities : - When the client is obtained from the VPN headend using a web browser, a helper application performs the download and installation. This helper application does not verify the authenticity of the downloaded installer, which could allow an attacker to send malicious code to the user instead. Note 2.x versions prior to 2.5.3041 are affected by this vulnerability. (CVE-2011-2040) - When the VPNAPI COM module calls the ATL framework, certain input data are not properly validated. This could allow a buffer overflow, which could lead to arbitrary code execution. (CVE-2013-5559)
Upgrade to Cisco AnyConnect Secure Mobility Client 3.0(629) or later.