QwikSec

Security Database

CVE

CWE

Training

CVE-2011-2678

Published: Jul 7, 2011

Modified: Aug 6, 2024

PUBLISHED

Description

The Cisco VPN Client 5.0.7.0240 and 5.0.7.0290 on 64-bit Windows platforms uses weak permissions (NT AUTHORITY\INTERACTIVE:F) for cvpnd.exe, which allows local users to gain privileges by replacing this executable file with an arbitrary program, aka Bug ID CSCtn50645. NOTE: this vulnerability exists because of a CVE-2007-4415 regression.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

20110628 NGS00051 Technical Advisory: Cisco VPN Client Privilege Escalation

mailing-list

x_refsource_BUGTRAQ

http://isc.sans.edu/diary.html?storyid=11125

x_refsource_MISC

20070815 Local Privilege Escalation Vulnerabilities in Cisco VPN Client

vendor-advisory

x_refsource_CISCO

third-party-advisory

x_refsource_SREASON

cisco-vpn-cvpnd-priv-esc(68485)

vdb-entry

x_refsource_XF

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.