Lucene search

MitreCVE-2007-4415

HistoryAug 18, 2007 - 9:17 p.m.

CVE-2007-4415

2007-08-1821:17:00

mitre

web.nvd.nist.gov

cisco

vpn

client

vulnerability

cve-2007-4415

nvd

CVSS2

6.8

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:S/C:C/I:C/A:C

AI Score

6.4

Confidence

Low

EPSS

Percentile

5.1%

JSON

Cisco VPN Client on Windows before 5.0.01.0600, and the 5.0.01.0600 InstallShield (IS) release, uses weak permissions for cvpnd.exe (Modify granted to Interactive Users), which allows local users to gain privileges via a modified cvpnd.exe.

Affected configurations

Nvd

Node

ciscovpn_clientRange≤5.0.01windows

ciscovpn_clientMatch5.0.01.0600

VendorProductVersionCPE
ciscovpn_client*cpe:2.3:a:cisco:vpn_client:*:*:windows:*:*:*:*:*
ciscovpn_client5.0.01.0600cpe:2.3:a:cisco:vpn_client:5.0.01.0600:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	vpn_client	*	cpe:2.3:a:cisco:vpn_client:::windows:::::*
cisco	vpn_client	5.0.01.0600	cpe:2.3:a:cisco:vpn_client:5.0.01.0600:::::::*

References

secunia.com/advisories/26459

securityreason.com/securityalert/3023

securitytracker.com/id?1018573

www.cisco.com/warp/public/707/cisco-sa-20070815-vpnclient.shtml

www.securityfocus.com/archive/1/476812/100/0/threaded

www.securityfocus.com/bid/25332

www.vupen.com/english/advisories/2007/2903

exchange.xforce.ibmcloud.com/vulnerabilities/36032

CVSS2

6.8

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:S/C:C/I:C/A:C

AI Score

6.4

Confidence

Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2007-4415