CVE-2018-0373

Description

A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobility Client for Windows Desktop could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to improper validation of user-supplied data. An attacker could exploit this vulnerability by sending a malicious request to the application. A successful exploit could allow the attacker to cause a DoS condition on the affected system. Cisco Bug IDs: CSCvj47654.

Related CPE's

aciscoanyconnect_secure_mobility_client4.5\(58\)*******

aciscoanyconnect_secure_mobility_client4.5\(1044\)*******

aciscoanyconnect_secure_mobility_client4.5\(2033\)*******

aciscoanyconnect_secure_mobility_client4.5\(2036\)*******

aciscoanyconnect_secure_mobility_client4.5\(3040\)*******

aciscoanyconnect_secure_mobility_client4.5\(4029\)*******

aciscoanyconnect_secure_mobility_client4.5\(5030\)*******

aciscoanyconnect_secure_mobility_client4.6\(1098\)*******

aciscoanyconnect_secure_mobility_client4.6\(362\)*******

omicrosoftwindows-*******

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-anyconnect-dos

Vendor Advisory

1041176

Third Party AdvisoryVDB Entry

104548

Third Party AdvisoryVDB Entry

CvssV3 impact

BaseSeverity

MEDIUM

ConfidentialityImpact

NONE

AttackComplexity

LOW

Scope

UNCHANGED

AttackVector

LOCAL

AvailabilityImpact

HIGH

IntegrityImpact

NONE

PrivilegesRequired

LOW

BaseScore

5.5

VectorString

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Version

3.0

UserInteraction

NONE

CvssV2 impact

Version

2.0

VectorString

AV:L/AC:L/Au:N/C:N/I:N/A:C

AccessVector

LOCAL

AccessComplexity

LOW

Authentication

NONE

ConfidentialityImpact

NONE

IntegrityImpact

NONE

AvailabilityImpact

COMPLETE

BaseScore

4.900000095367432

Created by Yello
About Severity.io