SB2021050617 - Multiple vulnerabilities in Cisco AnyConnect Secure Mobility Client

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2021-1519)

The vulnerability allows a remote attacker to overwrite VPN profiles on the target device.

The vulnerability exists due to insufficient validation of user-supplied input in the interprocess communication (IPC) channel. A local user can send a specially crafted IPC message to the AnyConnect process and modify VPN profile files.

2) Creation of Temporary File With Insecure Permissions (CVE-ID: CVE-2021-1429)

The vulnerability allows a local user to perform an executable hijacking attack.

The vulnerability exists due to a temporary file with insecure permissions is created during the uninstall process. A local user can overwrite the temporary file before it is accessed for execution and execute arbitrary code on the target device.

3) Insecure DLL loading (CVE-ID: CVE-2021-1428)

The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists due to the application loads a DLL file from a user-writable directory. A local user can place a specially crafted .dll file and execute arbitrary code on victim's system.

Remediation

Install update from vendor's website.

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-profile-AggMUCDg
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-code-exec-jR3tWTA6