CVE-2012-2493: Input Validation
The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 on Windows, and 2.x before 2.5 MR6 and 3.x before 3.0 MR8 on Mac OS X and Linux, does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components, aka Bug ID CSCtw47523.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2493?
CVE-2012-2493 is considered a medium to high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2012-2493?
To fix CVE-2012-2493, you should upgrade to Cisco AnyConnect Secure Mobility Client version 2.5 MR6 or later on Windows, and 3.0 MR8 or later on Mac OS X and Linux.
What impact does CVE-2012-2493 have on my system?
CVE-2012-2493 allows attackers to execute arbitrary code on affected systems by exploiting the improper validation of downloaded binaries.
Is my version of Cisco AnyConnect vulnerable to CVE-2012-2493?
Versions of Cisco AnyConnect Secure Mobility Client prior to 2.5 MR6 on Windows and prior to 3.0 MR8 on Mac OS X and Linux are vulnerable to CVE-2012-2493.
How can I determine if my software is at risk for CVE-2012-2493?
You can check your installed version of Cisco AnyConnect Secure Mobility Client against known vulnerable versions listed for CVE-2012-2493.