CVE-2012-2499: Medium severity cisco AnyConnect Secure Mobility Client vulnerability
The IPsec implementation in Cisco AnyConnect Secure Mobility Client 3.0 before 3.0.08057 does not verify the certificate name in an X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate, aka Bug ID CSCtz26985.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2499?
CVE-2012-2499 is considered a high severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2012-2499?
To mitigate CVE-2012-2499, upgrade to Cisco AnyConnect Secure Mobility Client version 3.0.08057 or later.
Who is affected by CVE-2012-2499?
CVE-2012-2499 affects users of Cisco AnyConnect Secure Mobility Client versions 3.0, 3.0.0629, and 3.0.07059.
What is the main issue with CVE-2012-2499?
The main issue with CVE-2012-2499 is that it does not verify the certificate name in X.509 certificates, allowing for server spoofing.
Is there a patch available for CVE-2012-2499?
Yes, a patch is available in the updated version of Cisco AnyConnect Secure Mobility Client 3.0.08057 and later.