Cisco AnyConnect Secure Mobility Client on Windows IPC uncontrolled search path

Summaryinfo

A vulnerability was found in Cisco AnyConnect Secure Mobility Client on Windows and classified as critical. Affected by this issue is some unknown functionality of the component IPC Handler. The manipulation results in uncontrolled search path. This vulnerability is identified as CVE-2020-3433. The attack is only possible with local access. Additionally, an exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Cisco AnyConnect Secure Mobility Client on Windows (Network Encryption Software) (the affected version is unknown). Affected is an unknown code of the component IPC Handler. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. CWE is classifying the issue as CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.

The weakness was released 08/17/2020 as cisco-sa-anyconnect-dll-F26WwJ as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is traded as CVE-2020-3433 since 12/12/2019. The attack needs to be approached locally. A authentication is needed for exploitation. Technical details are unknown but an exploit is available. The MITRE ATT&CK project declares the attack technique as T1574.

It is declared as attacked. This issue was added on 10/24/2022 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 11/14/2022:

Apply updates per vendor instructions.

Upgrading eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-159998 and VDB-159997. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Network Encryption Software

Vendor

• Cisco

Name

• AnyConnect Secure Mobility Client

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion