CVE-2011-0926

A certain ActiveX control in CSDWebInstaller.ocx in Cisco Secure Desktop (CSD) does not properly verify the signature of an unspecified downloaded program, which allows remote attackers to execute arbitrary code by spoofing the CSD installation process, a different vulnerability than CVE-2010-0589.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.zerodayinitiative.com/advisories/ZDI-11-091/
http://www.vupen.com/english/advisories/2011/0513
http://www.securitytracker.com/id?1025118
http://www.securityfocus.com/bid/46536
http://securityreason.com/securityalert/8105
https://exchange.xforce.ibmcloud.com/vulnerabilities/65755
http://www.securityfocus.com/archive/1/516647/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:secure_desktop:*:*:*:*:*:*:*:*

Information

Published : 2011-02-25 10:00

Updated : 2018-10-09 12:30

NVD link : CVE-2011-0926

Mitre link : CVE-2011-0926

JSON object : View

CWE

CWE-20

Improper Input Validation

Advertisement

Products Affected

cisco

secure_desktop

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.zerodayinitiative.com/advisories/ZDI-11-091/", "name": "http://www.zerodayinitiative.com/advisories/ZDI-11-091/", "tags": [], "refsource": "MISC"}, {"url": "http://www.vupen.com/english/advisories/2011/0513", "name": "ADV-2011-0513", "tags": [], "refsource": "VUPEN"}, {"url": "http://www.securitytracker.com/id?1025118", "name": "1025118", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.securityfocus.com/bid/46536", "name": "46536", "tags": [], "refsource": "BID"}, {"url": "http://securityreason.com/securityalert/8105", "name": "8105", "tags": [], "refsource": "SREASON"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65755", "name": "cisco-securedesktop-activex-code-execution(65755)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/516647/100/0/threaded", "name": "20110223 ZDI-11-091: (0day) Cisco Secure Desktop CSDWebInstaller Remote Code Execution Vulnerability", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "A certain ActiveX control in CSDWebInstaller.ocx in Cisco Secure Desktop (CSD) does not properly verify the signature of an unspecified downloaded program, which allows remote attackers to execute arbitrary code by spoofing the CSD installation process, a different vulnerability than CVE-2010-0589."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-20"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2011-0926", "ASSIGNER": "psirt@cisco.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2011-02-25T18:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:cisco:secure_desktop:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-09T19:30Z"}