CVE-2011-2039
published 2011-06-02CVE-2011-2039: The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows Mobile, downloads…
PriorityP268high7.6CVSS 2.0
AVNACHAuNCCICAC
EXPLOIT
EPSS
69.96%
99.3th percentile
The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows Mobile, downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a certain ActiveX control in vpnweb.ocx, aka Bug ID CSCsy00904.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | anyconnect_secure_mobility | — | — |
| cisco | anyconnect_secure_mobility_client | <= 2.3 | — |
| cisco | anyconnect_secure_mobility_client | — | — |
| cisco | anyconnect_secure_mobility_client | — | — |
| cisco | anyconnect_secure_mobility_client | — | — |
| cisco | anyconnect_secure_mobility_client | — | — |
| cisco | anyconnect_secure_mobility_client | — | — |
| cisco | anyconnect_secure_mobility_client | — | — |
| cisco | anyconnect_secure_mobility_client | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Cisco AnyConnect VPN Secure Mobility Client Cisco.AnyConnect.VPNWeb.1 Arbitrary Program Execution Attempt"; flow:established,to_client; file.data; content:"ActiveXObject"; nocase; content:"Cisco.AnyConnect.VPNWeb.1"; fast_pattern; nocase; distance:0; content:"url"; nocase; distance:0; reference:url,labs.idefense.com/intelligence/vulnerabilities/display.php?id=909; reference:bid,48081; reference:cve,2011-2039; reference:cve,2011-2040; classtype:attempted-user; sid:2012930; rev:5; metadata:created_at 2011_06_03, cve CVE_2011_2039, confidence Medium, signature_severity Unknown, updated_at 2024_04_09;)
- →Exploit HTML instantiates the ActiveX control by ProgID 'Cisco.AnyConnect.VPNWeb.1' and sets the 'url' property — detect co-occurrence of these strings in HTTP responses.
- →The ActiveX CLSID 55963676-2F5E-4BAF-AC28-CF26AA587566 (vpnweb.ocx) being instantiated via JavaScript in a browser page is a strong indicator of exploitation. ↗
- →The exploit also requests an 'updates.txt' file from the attacker-controlled server prior to delivering the payload executable — a two-stage HTTP request pattern (updates.txt then vpndownloader.exe) from the same host is suspicious. ↗
- ·The Snort/ET rule (sid:2012930) also covers CVE-2011-2040 in addition to CVE-2011-2039; tune accordingly to avoid false attribution.
- ·The exploit uses JSObfu obfuscation on the delivered HTML, so static string matching on 'Cisco.AnyConnect.VPNWeb.1' or the CLSID may be evaded by obfuscated variants — consider behavioural detection of vpndownloader.exe spawning from a browser process. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
vendor_cisco
CVE-2011-2039 Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
CVE-2011-2039: Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
The Cisco AnyConnect Secure Mobility Client, previously known as the Cisco AnyConnect VPN Client, is affected by the following vulnerabilities: Arbitrary Program Execution Vulnerability Local Privilege Escalation Vulnerability Cisco has released software updates that address these vulnerabilities. There are no
Bug IDs: CSCsy00904, CSCsy05934, CSCsy00904, CSCsy05934, CSCta40556
GHSA
GHSA-vjg9-jfmj-x6jf: The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2
ghsa_unreviewed·2022-05-17
CVE-2011-2039 [HIGH] CWE-20 GHSA-vjg9-jfmj-x6jf: The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2
The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows Mobile, downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a certain ActiveX control in vpnweb.ocx, aka Bug ID CSCsy00904.
Suricata
ET ACTIVEX Cisco AnyConnect VPN Secure Mobility Client Cisco.AnyConnect.VPNWeb.1 Arbitrary Program Execution Attempt
suricata·2011-06-03
CVE-2011-2039 ET ACTIVEX Cisco AnyConnect VPN Secure Mobility Client Cisco.AnyConnect.VPNWeb.1 Arbitrary Program Execution Attempt
ET ACTIVEX Cisco AnyConnect VPN Secure Mobility Client Cisco.AnyConnect.VPNWeb.1 Arbitrary Program Execution Attempt
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Cisco AnyConnect VPN Secure Mobility Client Cisco.AnyConnect.VPNWeb.1 Arbitrary Program Execution Attempt"; flow:established,to_client; file.data; content:"ActiveXObject"; nocase; content:"Cisco.AnyConnect.VPNWeb.1"; fast_pattern; nocase; distance:0; content:"url"; nocase; distance:0; reference:url,labs.idefense.com/intelligence/vulnerabilities/display.php?id=909; reference:bid,48081; reference:cve,2011-2039; reference:cve,2011-2040; classtype:attempted-user; sid:2012930; rev:5; metadata:created_at 2011_06_03, cve CVE_2011_2039, confidence Medium, signature_severity Unknown, updated_at 2024_04_09;)
Exploit-DB
Cisco AnyConnect VPN Client - ActiveX URL Property Download and Execute (Metasploit)
exploitdb·2011-06-06
CVE-2011-2039 Cisco AnyConnect VPN Client - ActiveX URL Property Download and Execute (Metasploit)
Cisco AnyConnect VPN Client - ActiveX URL Property Download and Execute (Metasploit)
---
##
# $Id: cisco_anyconnect_exec.rb 12872 2011-06-06 20:15:51Z bannedit $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Cisco AnyConnect VPN Client ActiveX URL Property Download and Execute',
'Description' => %q{
This module exploits a vulnerability in the Cisco AnyConnect VPN client
vpnweb.ocx ActiveX control. This control is typically used to install the
VPN client. An attacker can set the 'url' property which is where the control
tries to locate the
Metasploit
Cisco AnyConnect VPN Client ActiveX URL Property Download and Execute
metasploit
Cisco AnyConnect VPN Client ActiveX URL Property Download and Execute
Cisco AnyConnect VPN Client ActiveX URL Property Download and Execute
This module exploits a vulnerability in the Cisco AnyConnect VPN client vpnweb.ocx ActiveX control. This control is typically used to install the VPN client. An attacker can set the 'url' property which is where the control tries to locate the files needed to install the client. The control tries to download two files from the site specified within the 'url' property. One of these files it will be stored in a temporary directory and executed.
No writeups or analysis indexed.
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=909http://osvdb.org/72714http://securityreason.com/securityalert/8272http://www.cisco.com/en/US/products/products_security_advisory09186a0080b80123.shtmlhttp://www.kb.cert.org/vuls/id/490097http://www.securitytracker.com/id?1025591https://exchange.xforce.ibmcloud.com/vulnerabilities/67739http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=909http://osvdb.org/72714http://securityreason.com/securityalert/8272http://www.cisco.com/en/US/products/products_security_advisory09186a0080b80123.shtmlhttp://www.kb.cert.org/vuls/id/490097http://www.securitytracker.com/id?1025591https://exchange.xforce.ibmcloud.com/vulnerabilities/67739
2011-06-02
Published