Vulnerability CVE-2007-1064
Published: 2007-02-21   Modified: 2012-02-12

Description:
Cisco Secure Services Client (CSSC) 4.x, Trust Agent 1.x and 2.x, Cisco Security Agent (CSA) 5.0 and 5.1 (when a vulnerable Trust Agent has been deployed), and the Meetinghouse AEGIS SecureConnect Client do not drop privileges when the help facility in the supplicant GUI is invoked, which allows local users to gain privileges, aka CSCsf14120.

CVSS2 => (AV:L/AC:L/Au:S/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
10/10
3.1/10
Exploit range
Attack complexity
Authentication
Local
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Meetinghouse -> Aegis secureconnect client 
Cisco -> Secure services client 
Cisco -> Security agent 
Cisco -> Trust agent 

 References:
http://www.cisco.com/warp/public/707/cisco-sa-20070221-supplicant.shtml
http://xforce.iss.net/xforce/xfdb/32621
http://www.vupen.com/english/advisories/2007/0690
http://www.securitytracker.com/id?1017684
http://www.securitytracker.com/id?1017683
http://www.securityfocus.com/bid/22648
http://secunia.com/advisories/24258
http://osvdb.org/33049
Copyright 2024, cxsecurity.com

 

Back to Top