|
Description
|
|
A vulnerability has been identified in Cisco AnyConnect Secure Mobility Client.
A remote attacker could exploit it in order to access unauthorized directories by inciting their victims to connect to a head-end system. This system can be used to pass back crafted configuration attributes, which the attacker could leverage to execute a directory traversal attack and potentially modify arbitrary files.
|
|
|
|
|
|
Vulnerable Products
|
|
Vulnerable Software:
AnyConnect Secure Mobility Client (Cisco) - 4.0(2049)
|
|
|
|
|
|
Solution
|
|
Cisco announces that new versions for AnyConnect Secure Mobility Client are available.
|
|
|
|
|
|
CVE
|
|
CVE-2015-4289
|
|
|
|
|
|
References
|
|
- CSCut93920: Cisco AnyConnect Secure Mobilty Client Directory Traversal Vulnerability
http://tools.cisco.com/security/center/viewAlert.x?alertId=40175
|
|
|
|
|
|
Vulnerability Manager Detection
|
|
No
|
|
|
|
|
|
IPS Protection
|
|
|
|
|
|
|
