CVE-2015-6306
published 2015-09-26CVE-2015-6306: Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions, which allows local users to obtain root…
PriorityP334high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
1.05%
60.4th percentile
Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions, which allows local users to obtain root privileges via a crafted installation file, aka Bug ID CSCuv11947.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | anyconnect_secure_mobility_client | — | — |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_cisco7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco AnyConnect Secure Mobility Client for Linux and Mac OS X Privilege Escalation Vulnerability
vendor_cisco·2015-09-23·CVSS 7.2
CVE-2015-6306 [HIGH] CWE-264 Cisco AnyConnect Secure Mobility Client for Linux and Mac OS X Privilege Escalation Vulnerability
Cisco AnyConnect Secure Mobility Client for Linux and Mac OS X Privilege Escalation Vulnerability
A vulnerability in the code responsible for the self-updating feature of Cisco AnyConnect Secure Mobility Client for Linux and the Cisco AnyConnect Secure Mobility Client for Mac OS X could allow an authenticated, local attacker to execute an arbitrary executable file of its choosing with privileges equivalent to the Linux or Mac OS X root account.
The vulnerability is due to lack of checks in the code for the path and filename of the file being installed. An attacker could exploit this vulnerability by invoking this functionality with a crafted installation file. A successful exploit could allow the attacker to execute commands on the underlying Linux or Mac OS X host with privileges equiva
GHSA
GHSA-3rhg-qq6v-6gmc: Cisco AnyConnect Secure Mobility Client 4
ghsa_unreviewed·2022-05-14
CVE-2015-6306 [HIGH] GHSA-3rhg-qq6v-6gmc: Cisco AnyConnect Secure Mobility Client 4
Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions, which allows local users to obtain root privileges via a crafted installation file, aka Bug ID CSCuv11947.
No detection rules found.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/133685/Cisco-AnyConnect-DMG-Install-Script-Privilege-Escalation.htmlhttp://seclists.org/fulldisclosure/2015/Sep/86http://tools.cisco.com/security/center/viewAlert.x?alertId=41135http://www.securityfocus.com/archive/1/536534/100/0/threadedhttp://www.securitytracker.com/id/1033656https://www.exploit-db.com/exploits/38303/https://www.securify.nl/advisory/SFY20150701/cisco_anyconnect_elevation_%20of_privileges_via_dmg_install_script.htmlhttp://packetstormsecurity.com/files/133685/Cisco-AnyConnect-DMG-Install-Script-Privilege-Escalation.htmlhttp://seclists.org/fulldisclosure/2015/Sep/86http://tools.cisco.com/security/center/viewAlert.x?alertId=41135http://www.securityfocus.com/archive/1/536534/100/0/threadedhttp://www.securitytracker.com/id/1033656https://www.exploit-db.com/exploits/38303/https://www.securify.nl/advisory/SFY20150701/cisco_anyconnect_elevation_%20of_privileges_via_dmg_install_script.html
2015-09-26
Published