CVE-2012-2495

CVSS V2 Medium 4.3 CVSS V3 None
Description
The HostScan downloader implementation in Cisco AnyConnect Secure Mobility Client 3.x before 3.0 MR8 and Cisco Secure Desktop before 3.6.6020 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a version downgrade by using (1) ActiveX or (2) Java components to offer signed code that corresponds to an older software release, aka Bug ID CSCtx74235.
Overview
  • CVE ID
  • CVE-2012-2495
  • Assigner
  • ykramarz@cisco.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2012-06-20T20:55:02
  • Last Modified Date
  • 2012-06-21T04:00:00
Weakness Enumerations
CWE URL
CWE-20 http://cwe.mitre.org/data/definitions/20.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:cisco:anyconnect_secure_mobility_client:3.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:cisco:secure_desktop:*:*:*:*:*:*:*:* 1 OR 3.5.2008
cpe:2.3:a:cisco:secure_desktop:3.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:cisco:secure_desktop:3.1.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:cisco:secure_desktop:3.1.1.27:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:cisco:secure_desktop:3.1.1.33:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:cisco:secure_desktop:3.1.1.45:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:cisco:secure_desktop:3.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:cisco:secure_desktop:3.2.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:cisco:secure_desktop:3.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:cisco:secure_desktop:3.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:cisco:secure_desktop:3.4.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:cisco:secure_desktop:3.4.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:cisco:secure_desktop:3.4.2048:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:cisco:secure_desktop:3.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:cisco:secure_desktop:3.5.841:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:cisco:secure_desktop:3.5.1077:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:cisco:secure_desktop:3.5.2001:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:N/I:P/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • NONE
  • Base Score
  • 4.3
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8.6
  • Impact Score
  • 2.9
References
Reference URL Reference Tags
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac Vendor Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2012-2495
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2495
History
Created Old Value New Value Data Type Notes
2022-05-10 10:54:13 Added to TrackCVE