Privilege escalation in Cisco AnyConnect Secure Mobility Client

1) Privilege escalation

EUVDB-ID: #VU7001

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-6638

CWE-ID: CWE-427 - Uncontrolled Search Path Element

Exploit availability: No

Description

The vulnerability allows a local authenticated attacker to gain elevated privileges.

The weakness exists on Cisco AnyConnect Secure Mobility Client for Windows due to uncontrolled search path element. A local attacker can copy a specially crafted DLL file to a specific directory on the system and execute arbitrary code on the underlying Microsoft Windows host with SYSTEM privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update to version 4.4.02034.

Vulnerable software versions

Cisco AnyConnect Secure Mobility Client: 4.3.754

CPE2.3

• cpe:2.3:a:cisco_systems:cisco_anyconnect_secure_mobility_client:4.3.754:*:*:*:*:*:*:*

External links

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-anyconnect

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.