漏洞描述
The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows Mobile, downloads a client executable file (vpndownloader.exe) without verifying its authenticity, which allows remote attackers to execute arbitrary code via the url property to a certain ActiveX control in vpnweb.ocx, aka Bug ID CSCsy00904.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
www.securitytracker.comhttp://www.securitytracker.com/id?1025591↗labs.idefense.comhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=909↗www.kb.cert.orghttp://www.kb.cert.org/vuls/id/490097↗osvdb.orghttp://osvdb.org/72714↗exchange.xforce.ibmcloud.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/67739↗securityreason.comhttp://securityreason.com/securityalert/8272↗www.cisco.comhttp://www.cisco.com/en/US/products/products_security_advisory09186a0080b80123.shtml↗