CVE-2012-0358

Related Files

Cisco Security Advisory 20120314-asaclient

Posted Mar 15, 2012

Authored by Cisco Systems | Site cisco.com

Cisco Security Advisory - The Cisco Clientless VPN solution as deployed by Cisco ASA 5500 Series Adaptive Security Appliances (Cisco ASA) uses an ActiveX control on client systems to perform port forwarding operations. Microsoft Windows-based systems that are running Internet Explorer or another browser that supports Microsoft ActiveX technology may be affected if the system has ever connected to a device that is running the Cisco Clientless VPN solution. A remote, unauthenticated attacker who could convince a user to connect to a malicious web page could exploit this issue to execute arbitrary code on the affected machine with the privileges of the web browser. The affected ActiveX control is distributed to endpoint systems by Cisco ASA. However, the impact of successful exploitation of this vulnerability is to the endpoint system only and does not compromise Cisco ASA devices. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available.

tags | advisory, remote, web, arbitrary, activex

systems | cisco, windows

advisories | CVE-2012-0358

SHA-256 | d5eb4f15929e22adebee6cabc4901b0a19fd375282c7f4226edd361bb721237f

Download | Favorite | View