CVE-2015-0663: Medium severity cisco AnyConnect Secure Mobility Client vulnerability
Published Mar 17, 2015
·Updated
Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier does not properly implement access control for IPC messages, which allows local users to write to arbitrary files via crafted messages, aka Bug ID CSCus79392.
Affected Software
1 affected component
cisco AnyConnect Secure Mobility Client<=4.0\(.00051\)
Event History
Mar 17, 2015
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-0663?
CVE-2015-0663 is considered a high severity vulnerability allowing local users to write to arbitrary files.
2
How do I fix CVE-2015-0663?
To mitigate CVE-2015-0663, update the Cisco AnyConnect Secure Mobility Client to a version later than 4.0(00051).
3
Who is affected by CVE-2015-0663?
CVE-2015-0663 affects users of Cisco AnyConnect Secure Mobility Client version 4.0(00051) and earlier.
4
What type of vulnerability is CVE-2015-0663?
CVE-2015-0663 is an access control vulnerability related to improper handling of IPC messages.
5
Can CVE-2015-0663 be exploited remotely?
No, CVE-2015-0663 requires local access, as it allows exploitation through IPC messages from local users.