CVE-2012-4655
published 2012-09-24CVE-2012-4655: The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows…
PriorityP352critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
4.64%
90.6th percentile
The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components, aka Bug IDs CSCtz76128 and CSCtz78204.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | anyconnect_secure_mobility | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
| cisco | secure_desktop | — | — |
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_cisco9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h48c-fg4r-j3m4: The WebLaunch feature in Cisco Secure Desktop before 3
ghsa_unreviewed·2022-05-17
CVE-2012-4655 [HIGH] CWE-20 GHSA-h48c-fg4r-j3m4: The WebLaunch feature in Cisco Secure Desktop before 3
The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components, aka Bug IDs CSCtz76128 and CSCtz78204.
Cisco
Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
vendor_cisco·2012-06-20·CVSS 9.3
CVE-2012-2493 [CRITICAL] CWE-399 Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
The Cisco AnyConnect Secure Mobility Client is affected by the following vulnerabilities:
Cisco AnyConnect Secure Mobility Client VPN Downloader Arbitrary Code Execution Vulnerability
Cisco AnyConnect Secure Mobility Client VPN Downloader Software Downgrade Vulnerability
Cisco AnyConnect Secure Mobility Client and Cisco Secure Desktop Hostscan Downloader Software Downgrade Vulnerability
Cisco AnyConnect Secure Mobility Client 64-bit Java VPN Downloader Arbitrary Code Execution Vulnerability
Cisco Secure Desktop Arbitrary Code Execution Vulnerability
Cisco has released software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available. This advisory is available at the foll
Cisco
Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
vendor_cisco
CVE-2012-4655 Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
CVE-2012-4655: Multiple Vulnerabilities in Cisco AnyConnect Secure Mobility Client
The Cisco AnyConnect Secure Mobility Client is affected by the following vulnerabilities: Cisco AnyConnect Secure Mobility Client VPN Downloader Arbitrary Code Execution Vulnerability Cisco AnyConnect Secure Mobility Client VPN Downloader Software Downgrade Vulnerability Cisco AnyConnect Secure Mobility Client and Cisco Secure Desktop Hostscan Downloader Software Downgrade Vulnerability Cisco AnyConnect Secure Mobility Client 64-bit Java VPN Downloader Arbitrary Code Execution Vulnerability Cisco Secure Desktop Arbitrary Code Execution Vulnerability Cisco has released software updates that address these vulnerabilities.
CWE: CWE-399, CWE-399
Bug IDs: CSCtw47523, CSCtw48681, CSCtx74235, CSCtw47523, CSCtw48681
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://secunia.com/advisories/50669http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-achttp://www.securityfocus.com/bid/55606https://exchange.xforce.ibmcloud.com/vulnerabilities/78677http://secunia.com/advisories/50669http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-achttp://www.securityfocus.com/bid/55606https://exchange.xforce.ibmcloud.com/vulnerabilities/78677
2012-09-24
Published