CVE-2012-2496: Input Validation

Published Jun 20, 2012

Updated

A certain Java applet in the VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR7 on 64-bit Linux platforms does not properly restrict use of Java components, which allows remote attackers to execute arbitrary code via a crafted web site, aka Bug ID CSCty45925.

Affected Software

1 affected component

cisco AnyConnect Secure Mobility Client=3.0

Event History

Jun 20, 2012

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-2496?

CVE-2012-2496 is classified as a critical vulnerability due to its potential to allow remote code execution.

How do I fix CVE-2012-2496?

To fix CVE-2012-2496, upgrade Cisco AnyConnect Secure Mobility Client to version 3.0 MR7 or later.

What platforms are affected by CVE-2012-2496?

CVE-2012-2496 affects 64-bit Linux platforms running Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR7.

What type of attack is possible with CVE-2012-2496?

CVE-2012-2496 allows remote attackers to execute arbitrary code via a crafted web site.

Who is responsible for addressing CVE-2012-2496?

It is the user's responsibility to apply the necessary updates to mitigate the risks associated with CVE-2012-2496.