Mac OS X : Cisco AnyConnect Secure Mobility Client < 3.1.13015.0 / 4.2.x < 4.2.1035.0 Multiple OpenSSL Vulnerabilities
medium Nessus Plugin ID 88101
Language:
Synopsis
The remote host is affected by multiple vulnerabilities.Description
The Cisco AnyConnect Secure Mobility Client installed on the remote Mac OS X host is a version prior to 3.1.13015.0 or 4.2.x prior to 4.2.1035.0. It is, therefore, affected by multiple vulnerabilities in the bundled version of OpenSSL :- A carry propagating flaw exists in the x86_64 Montgomery squaring implementation that may cause the BN_mod_exp() function to produce incorrect results. An attacker can exploit this to obtain sensitive information regarding private keys. (CVE-2015-3193)
- A NULL pointer dereference flaw exists in file rsa_ameth.c when handling ASN.1 signatures that use the RSA PSS algorithm but are missing a mask generation function parameter. A remote attacker can exploit this to cause the signature verification routine to crash, leading to a denial of service. (CVE-2015-3194)
- A flaw exists in the ASN1_TFLG_COMBINE implementation in file tasn_dec.c related to handling malformed X509_ATTRIBUTE structures. A remote attacker can exploit this to cause a memory leak by triggering a decoding failure in a PKCS#7 or CMS application, resulting in a denial of service. (CVE-2015-3195)
- A race condition exists in s3_clnt.c that is triggered when PSK identity hints are incorrectly updated in the parent SSL_CTX structure when they are received by a multi-threaded client. A remote attacker can exploit this, via a crafted ServerKeyExchange message, to cause a double-free memory error, resulting in a denial of service. (CVE-2015-3196)
- A flaw exists in the ssl3_get_key_exchange() function in file s3_clnt.c when handling a ServerKeyExchange message for an anonymous DH ciphersuite with the value of 'p' set to 0. A attacker can exploit this, by causing a segmentation fault, to crash an application linked against the library, resulting in a denial of service.
(CVE-2015-1794)
Solution
Upgrade to Cisco AnyConnect Secure Mobility Client version 3.1.13015.0 / 4.2.1035.0 or later.See Also
http://www.nessus.org/u?4099a8d6
Plugin Details
Severity: Medium
ID: 88101
File Name: macosx_cisco_anyconnect_CSCux41420.nasl
Version: 1.8
Type: local
Agent: macosx
Family: MacOS X Local Security Checks
Published: 1/22/2016
Updated: 7/14/2018
Supported Sensors: Nessus Agent
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Temporal Vector: E:U/RL:OF/RC:C
Vulnerability Information
CPE: cpe:/a:cisco:anyconnect_secure_mobility_client
Required KB Items: installed_sw/Cisco AnyConnect Secure Mobility Client, Host/MacOSX/Version
Exploit Ease: No known exploits are available
Patch Publication Date: 12/4/2015
Vulnerability Publication Date: 8/11/2015
Reference Information
CVE: CVE-2015-3193, CVE-2015-3194, CVE-2015-3195, CVE-2015-3196, CVE-2015-1794