CVE-2012-2500: Medium severity cisco anyconnect secure vulnerability

Published Aug 6, 2012

Updated

Cisco AnyConnect Secure Mobility Client 3.0 before 3.0.08057 does not verify the certificate name in an X.509 certificate during WebLaunch of IPsec, which allows man-in-the-middle attackers to spoof servers via a crafted certificate, aka Bug ID CSCtz29470.

Affected Software

3 affected components

cisco AnyConnect Secure Mobility Client=3.0

cisco AnyConnect Secure Mobility Client=3.0.0629

cisco AnyConnect Secure Mobility Client=3.0.07059

Event History

Aug 6, 2012

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-2500?

CVE-2012-2500 is considered a moderate severity vulnerability due to its potential for man-in-the-middle attacks.

How do I fix CVE-2012-2500?

To fix CVE-2012-2500, you should upgrade to Cisco AnyConnect Secure Mobility Client version 3.0.08057 or later.

What versions of Cisco AnyConnect are affected by CVE-2012-2500?

CVE-2012-2500 affects Cisco AnyConnect Secure Mobility Client versions 3.0 prior to 3.0.08057.

What type of attack does CVE-2012-2500 allow?

CVE-2012-2500 allows man-in-the-middle attackers to spoof servers using a crafted X.509 certificate.

What functionality is compromised by CVE-2012-2500?

CVE-2012-2500 compromises the verification of certificate names during the WebLaunch of IPsec.