CVE-2010-0589

The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://securitytracker.com/id?1023881
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml	Patch Vendor Advisory
http://www.securityfocus.com/bid/39478
http://www.zerodayinitiative.com/advisories/ZDI-10-072/
https://exchange.xforce.ibmcloud.com/vulnerabilities/57812

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:secure_desktop::::::::
	cpe:2.3:a:cisco:secure_desktop:3.1:::::::*
	cpe:2.3:a:cisco:secure_desktop:3.1.1:::::::*
	cpe:2.3:a:cisco:secure_desktop:3.1.1.27:::::::*
	cpe:2.3:a:cisco:secure_desktop:3.1.1.33:::::::*
	cpe:2.3:a:cisco:secure_desktop:3.2:::::::*
	cpe:2.3:a:cisco:secure_desktop:3.2.1:::::::*
	cpe:2.3:a:cisco:secure_desktop:3.3:::::::*
	cpe:2.3:a:cisco:secure_desktop:3.4:::::::*
	cpe:2.3:a:cisco:secure_desktop:3.4.1:::::::*
	cpe:2.3:a:cisco:secure_desktop:3.4.2:::::::*
	cpe:2.3:a:cisco:secure_desktop:3.4.2048:::::::*

History

No history.

Information

Published : 2010-04-15 17:30

Updated : 2023-12-10 11:03

NVD link : CVE-2010-0589

Mitre link : CVE-2010-0589

CVE.ORG link : CVE-2010-0589

JSON object : View

Products Affected

cisco

secure_desktop

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2010-0589", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2010-04-15T17:30:00.523", "references": [{"url": "http://securitytracker.com/id?1023881", "source": "ykramarz@cisco.com"}, {"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml", "tags": ["Patch", "Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/39478", "source": "ykramarz@cisco.com"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-10-072/", "source": "ykramarz@cisco.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57812", "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876."}, {"lang": "es", "value": "El control ActiveX Web Install ActiveX en Cisco Secure Desktop (CSD) anterior a v3.5.841, no verifica adecuadamente las firmas de los programas descargados, lo que permite a atacantes remotos forzar las descargas y ejecuciones de archivos de su elecci\u00f3n a trav\u00e9s de una p\u00e1gina web manipulada. Tambi\u00e9n conocido con el Bug ID CSCta25876."}], "lastModified": "2017-08-17T01:32:02.523", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:secure_desktop:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B5E0489-A3D0-4FA8-BF36-7C329090F075", "versionEndIncluding": "3.5"}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6EE6B79A-FD31-4637-BE22-EEADF63B94FF"}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F2F8EA5-8DEF-48D0-9E7F-6047D4AECC5C"}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.1.1.27:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59D841B0-3D1B-4F1C-87F1-D0355955E49C"}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.1.1.33:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F13E414E-E56E-496E-A952-F93DCF1B1BDC"}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D7A8878-2E0F-4140-86DF-75999B47E4F5"}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4932BA9E-4156-4445-93E9-7A9F1D81090B"}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3497EB29-C406-44C1-AB28-0DDC4E79A9D9"}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6C63D54D-6424-4767-9832-41E7F0B1D1E9"}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4D4CF6F-2F81-45B0-9B5B-C8D79E74D6F4"}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA0286A4-6011-41DF-B607-44CFBBFD437F"}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.4.2048:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE277431-4101-4C0F-91DB-A1C15C0344FF"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}