CVE-2012-2495

Description

The HostScan downloader implementation in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR8 and Cisco Secure Desktop before 3.6.6020 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a version downgrade by using (1) ActiveX or (2) Java components to offer signed code that corresponds to an older software release, aka Bug ID CSCtx74235.

Risk Information

Base Score
7.5
MODERATE
Vector
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
Exploitation Probability
0.215

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2012-2495,CVE-2012-2496 are affected in Cisco AnyConnect Secure Mobility Client For Windows 3.0Windows
Vulnerabilities CVE-2011-2040,CVE-2012-2494,CVE-2012-2495,CVE-2012-2498 are affected in Cisco AnyConnect Secure Mobility Client for Mac 3.0Mac
Cisco AnyConnect Secure Mobility Client and Secure Desktop WebLaunch Software Downgrade Vulnerability For Cisco AnyConnect Secure Mobility ClientNCM
Improper Input Validation Vulnerability (CVE-2012-2495)NCM

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-1705981Security Update for Cisco AnyConnect Secure Mobility Client 4.3(2034)
PATCH-606843Cisco AnyConnect Secure Mobility Client for Mac 4.10.08029
PATCH-338372Cisco AnyConnect Secure Mobility Client (4.10.08029) (Manual Upload Required)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234