CVE-2015-7600: High severity cisco vpn client vulnerability
Published Oct 6, 2015
·Updated
Cisco VPN Client 5.x through 5.0.07.0440 uses weak permissions for vpnclient.ini, which allows local users to gain privileges by entering an arbitrary program name in the Command field of the ApplicationLauncher section.
Affected Software
20 affected components
Cisco VPN Client=5.0
Cisco VPN Client=5.0.01
Cisco VPN Client=5.0.01.0600
Cisco VPN Client=5.0.2
Cisco VPN Client=5.0.02.0090
Cisco VPN Client=5.0.2.0090
Cisco VPN Client=5.0.03.0530
Cisco VPN Client=5.0.03.0560
Cisco VPN Client=5.0.04.0300
Cisco VPN Client=5.0.5
Cisco VPN Client=5.0.05.0290
Cisco VPN Client=5.0.6
Cisco VPN Client=5.0.06.0160
Cisco VPN Client=5.0.7
Cisco VPN Client=5.0.7.0240
Cisco VPN Client=5.0.7.0290
Cisco VPN Client=5.0.07.0290
Cisco VPN Client=5.0.07.0410
Cisco VPN Client=5.0.07.0440
Cisco VPN Client=5.0.7.0440
Event History
Oct 6, 2015
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-7600?
CVE-2015-7600 has a moderate severity rating due to the potential for privilege escalation by local users.
2
How do I fix CVE-2015-7600?
To fix CVE-2015-7600, users should restrict permissions on the vpnclient.ini file to prevent unauthorized access.
3
Who is affected by CVE-2015-7600?
CVE-2015-7600 affects users of Cisco VPN Client versions 5.0.x, specifically up to 5.0.07.0440.
4
What type of vulnerability is CVE-2015-7600?
CVE-2015-7600 is a local privilege escalation vulnerability that arises from incorrect permissions.
5
What are the consequences of CVE-2015-7600?
If exploited, CVE-2015-7600 allows local users to execute arbitrary programs with elevated privileges.