Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2012-2495

The HostScan downloader implementation in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR8 and Cisco Secure Desktop before 3.6.6020 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a version downgrade by using (1) ActiveX or (2) Java components to offer signed code that corresponds to an older software release, aka Bug ID CSCtx74235.

Published

2012-06-20T20:55:02.590

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-20
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application cisco anyconnect_secure_mobility_client 3.0 Yes
Application cisco secure_desktop ≤ 3.5.2008 Yes
Application cisco secure_desktop 3.1 Yes
Application cisco secure_desktop 3.1.1 Yes
Application cisco secure_desktop 3.1.1.27 Yes
Application cisco secure_desktop 3.1.1.33 Yes
Application cisco secure_desktop 3.1.1.45 Yes
Application cisco secure_desktop 3.2 Yes
Application cisco secure_desktop 3.2.1 Yes
Application cisco secure_desktop 3.3 Yes
Application cisco secure_desktop 3.4 Yes
Application cisco secure_desktop 3.4.1 Yes
Application cisco secure_desktop 3.4.2 Yes
Application cisco secure_desktop 3.4.2048 Yes
Application cisco secure_desktop 3.5 Yes
Application cisco secure_desktop 3.5.841 Yes
Application cisco secure_desktop 3.5.1077 Yes
Application cisco secure_desktop 3.5.2001 Yes
References