CVE-2015-0663 : Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier does not properl

Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier does not properly implement access control for IPC messages, which allows local users to write to arbitrary files via crafted messages, aka Bug ID CSCus79392.

Published 2015-03-17 02:01:49

Updated 2015-10-28 02:17:01

Source Cisco Systems, Inc.

View at NVD, CVE.org

Products affected by CVE-2015-0663

Cisco » Anyconnect Secure Mobility Client
Versions up to, including, (<=) 4.0\(.00051\)
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-0663

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-0663

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.6	MEDIUM	AV:L/AC:L/Au:N/C:N/I:C/A:C	3.9	9.2	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2015-0663

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-0663

http://www.securitytracker.com/id/1031930

Cisco AnyConnect Secure Mobility Client Lets Local Users Write Arbitrary Files - SecurityTracker
http://tools.cisco.com/security/center/viewAlert.x?alertId=37863

Cisco AnyConnect Secure Mobility Client Arbitrary File Write Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2015-0663

Products affected by CVE-2015-0663

Exploit prediction scoring system (EPSS) score for CVE-2015-0663

CVSS scores for CVE-2015-0663

CWE ids for CVE-2015-0663

References for CVE-2015-0663