Vulnerability CVE-2011-0926
Published: 2011-02-25   Modified: 2012-02-13

Description:
A certain ActiveX control in CSDWebInstaller.ocx in Cisco Secure Desktop (CSD) does not properly verify the signature of an unspecified downloaded program, which allows remote attackers to execute arbitrary code by spoofing the CSD installation process, a different vulnerability than CVE-2010-0589.

See advisories in our WLB2 database:
Topic
Author
Date
High
Cisco Secure Desktop CSDWebInstaller Remote Code Execution Vulnerability
ZDI
27.02.2011

Type:

CWE-20

 (Improper Input Validation)

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9.3/10
10/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Cisco -> Secure desktop 

 References:
http://securityreason.com/securityalert/8105
http://www.securityfocus.com/archive/1/516647/100/0/threaded
http://www.securityfocus.com/bid/46536
http://www.securitytracker.com/id?1025118
http://www.vupen.com/english/advisories/2011/0513
http://www.zerodayinitiative.com/advisories/ZDI-11-091/
https://exchange.xforce.ibmcloud.com/vulnerabilities/65755
Copyright 2024, cxsecurity.com

 

Back to Top