Monday, September 25, 2023
LetsAskBinu.com
  • Home
  • Cybersecurity
  • Cyber Threats
  • Hacking
  • Protection
  • Networking
  • Malware
  • Fintech
  • Internet Of Things
No Result
View All Result
LetsAskBinu.com
No Result
View All Result
Home Hacking

Hackers Actively Exploiting Cisco AnyConnect Secure Flaw

Researcher by Researcher
October 26, 2022
in Hacking
0
Hackers Actively Exploiting Cisco AnyConnect Secure Flaw
189
SHARES
1.5k
VIEWS
Share on FacebookShare on Twitter


Cisco AnyConnect Secure

Cisco issued a warning of active exploitation attempts targeting two security vulnerabilities in the Cisco AnyConnect Secure Mobility Client for Windows. 

The security flaws are tracked as CVE-2020-3153 (CVSS score: 6.5) and CVE-2020-3433 (CVSS score: 7.8), which allows the attacker to copy malicious files to arbitrary locations with system-level privileges. Both the vulnerabilities are dated 2020 and are now patched.

CVE-2020-3153 – Installer Component of Cisco AnyConnect Secure Mobility Client for Windows

The vulnerability tracked as (CVE-2020-3153) resides in the installer component of the Cisco AnyConnect Secure Mobility Client for Windows. 


EHA

This allows an authenticated local attacker to copy user-supplied files to system-level directories with system-level privileges.

Cisco mentions that this security flaw occurred due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. 

This includes DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.

Vulnerable Products

Cisco says this vulnerability affected the Cisco AnyConnect Secure Mobility Client for Windows releases earlier than 4.8.02042.

Fix Available

Cisco AnyConnect Secure Mobility Client for Windows releases 4.8.02042 and later contained the fix for this vulnerability.

CVE-2020-3433 -Interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows

This vulnerability resides in the interprocess communication (IPC) channel of the Cisco AnyConnect Secure Mobility Client for Windows that allows an authenticated, local attacker to perform a DLL hijacking attack.

“To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system”, Cisco

The flaw is due to insufficient validation of resources that are loaded by the application at run time. Hence, an attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process.

Vulnerable Products

Cisco says this vulnerability affects Cisco AnyConnect Secure Mobility Client for Windows releases earlier than Release 4.9.00086.

This vulnerability does not affect the following Cisco products:

  • AnyConnect Secure Mobility Client for MacOS
  • AnyConnect Secure Mobility Client for Linux
  • AnyConnect Secure Mobility Client for mobile device operating systems such as iOS, Android, and Universal Windows Platform

Fix Available

Cisco addressed this vulnerability in Cisco AnyConnect Secure Mobility Client for Windows releases 4.9.00086 and later.

“In October 2022, the Cisco PSIRT became aware of additionally attempted exploitation of this vulnerability in the wild,” Cisco warned.

“Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.”

The alert follows the decision of the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add the two CISCO flaws to its Known Exploited Vulnerabilities catalog.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

“These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose a significant risk to the federal enterprise”, Cisco

Reports say federal agencies were given three weeks, until November 11th, to address both CISCO vulnerabilities.

Managed DDoS Attack Protection for Applications – Download Free Guide



Source link

Related articles

LUCR-3 Attacking Fortune 2000 Companies Using Victims’ Own Tools

LUCR-3 Attacking Fortune 2000 Companies Using Victims’ Own Tools

September 21, 2023
Trend Micro Zero-day Vulnerability Let Attackers Run Arbitrary Code

Trend Micro Zero-day Vulnerability Let Attackers Run Arbitrary Code

September 21, 2023
Tags: activelyAnyConnectCiscoExploitingFlawHackerssecure
Share76Tweet47

Related Posts

LUCR-3 Attacking Fortune 2000 Companies Using Victims’ Own Tools

LUCR-3 Attacking Fortune 2000 Companies Using Victims’ Own Tools

September 21, 2023
0

A new financially motivated threat group named “LUCR-3” has been discovered targeting organizations to steal intellectual property for extortion. This...

Trend Micro Zero-day Vulnerability Let Attackers Run Arbitrary Code

Trend Micro Zero-day Vulnerability Let Attackers Run Arbitrary Code

September 21, 2023
0

If you use Trend Micro Apex One, you should know that the third-party Antivirus uninstaller feature may have a security...

China Accuses the US of Hacking Huawei Servers Since 2009

China Accuses the US of Hacking Huawei Servers Since 2009

September 20, 2023
0

Huawei is known for its telecommunications equipment and consumer electronics, including smartphones, and the USA banned Huawei primarily due to...

Hackers have deployed a Linux backdoor to attack government entities

Hackers have deployed a Linux backdoor to attack government entities

September 20, 2023
0

Recent reports indicate that threat actors have been using a new type of Linux-targeted backdoor that has never been seen...

Hackers Attack Thousands of Organizations Using Password Spraying

Hackers Attack Thousands of Organizations Using Password Spraying

September 19, 2023
0

Peach Sandstorm, an Iranian Hackers group that targets organizations globally, aligns with the following threat groups:-Besides this, in the following...

Load More
  • Trending
  • Comments
  • Latest
This Week in Fintech: TFT Bi-Weekly News Roundup 08/02

This Week in Fintech: TFT Bi-Weekly News Roundup 15/03

March 15, 2022
Supply chain efficiency starts with securing port operations

Supply chain efficiency starts with securing port operations

March 15, 2022
Microsoft to Block Macros by Default in Office Apps

Qakbot Email Thread Hijacking Attacks Drop Multiple Payloads

March 15, 2022
QNAP Escalation Vulnerability Let Attackers Gain Administrator Privileges

QNAP Escalation Vulnerability Let Attackers Gain Administrator Privileges

March 15, 2022
Beware! Facebook accounts being hijacked via Messenger prize phishing chats

Beware! Facebook accounts being hijacked via Messenger prize phishing chats

0
Shoulder surfing: Watch out for eagle‑eyed snoopers peeking at your phone

Shoulder surfing: Watch out for eagle‑eyed snoopers peeking at your phone

0
Remote work causing security issues for system and IT administrators

Remote work causing security issues for system and IT administrators

0
Elementor WordPress plugin has a gaping security hole – update now – Naked Security

Elementor WordPress plugin has a gaping security hole – update now – Naked Security

0
‘Horse Gone Barn Bolted’ is Strong Password – Krebs on Security

‘Horse Gone Barn Bolted’ is Strong Password – Krebs on Security

September 23, 2023
SumUp Launches 7am Payouts; Offering UK Merchants Optimal Financial Flexibility

SumUp Launches 7am Payouts; Offering UK Merchants Optimal Financial Flexibility

September 23, 2023
Stealth Falcon preying over Middle Eastern skies with Deadglyph

Stealth Falcon preying over Middle Eastern skies with Deadglyph

September 23, 2023
Will you give X your biometric data? – Week in security with Tony Anscombe

ESET’s cutting-edge threat research at LABScon – Week in security with Tony Anscombe

September 23, 2023

Recent Posts

‘Horse Gone Barn Bolted’ is Strong Password – Krebs on Security

‘Horse Gone Barn Bolted’ is Strong Password – Krebs on Security

September 23, 2023
SumUp Launches 7am Payouts; Offering UK Merchants Optimal Financial Flexibility

SumUp Launches 7am Payouts; Offering UK Merchants Optimal Financial Flexibility

September 23, 2023
Stealth Falcon preying over Middle Eastern skies with Deadglyph

Stealth Falcon preying over Middle Eastern skies with Deadglyph

September 23, 2023

Categories

  • Cyber Threats
  • Cybersecurity
  • Fintech
  • Hacking
  • Internet Of Things
  • LetsAskBinuBlogs
  • Malware
  • Networking
  • Protection

Tags

Access attack Attacks banking BiWeekly bug Cisco cloud code critical Cyber Cybersecurity Data Digital exploited financial Fintech Flaw flaws Google Group Hackers Krebs Latest launches malware Microsoft million Network News open patches platform Ransomware RoundUp security Software Stories TFT Threat Top vulnerabilities vulnerability warns Week

© 2022 Lets Ask Binu All Rights Reserved

No Result
View All Result
  • Home
  • Cybersecurity
  • Cyber Threats
  • Hacking
  • Protection
  • Networking
  • Malware
  • Fintech
  • Internet Of Things

© 2022 Lets Ask Binu All Rights Reserved