Vulnerability CVE-2007-4415
Published: 2007-08-18   Modified: 2012-02-12

Description:
Cisco VPN Client on Windows before 5.0.01.0600, and the 5.0.01.0600 InstallShield (IS) release, uses weak permissions for cvpnd.exe (Modify granted to Interactive Users), which allows local users to gain privileges via a modified cvpnd.exe.

See advisories in our WLB2 database:
Topic
Author
Date
High
Local privilege escalation vulnerability in Cisco VPN client
ngssoftware
19.08.2007

Type:

CWE-Other

CVSS2 => (AV:L/AC:L/Au:S/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
10/10
3.1/10
Exploit range
Attack complexity
Authentication
Local
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Cisco -> Vpn client 

 References:
http://securityreason.com/securityalert/3023
http://securitytracker.com/id?1018573
http://www.cisco.com/warp/public/707/cisco-sa-20070815-vpnclient.shtml
http://www.securityfocus.com/archive/1/476812/100/0/threaded
http://www.securityfocus.com/bid/25332
http://www.vupen.com/english/advisories/2007/2903
https://exchange.xforce.ibmcloud.com/vulnerabilities/36032
Copyright 2024, cxsecurity.com

 

Back to Top