CVE-2018-0334

A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConnect Secure Mobility Client for iOS, Mac OS X, Android, Windows, and Linux could allow an unauthenticated, remote attacker to bypass the TLS certificate check when downloading certain configuration files. The vulnerability is due to improper use of Simple Certificate Enrollment Protocol and improper server certificate validation. An attacker could exploit this vulnerability by preparing malicious profile and localization files for Cisco AnyConnect to use. A successful exploit could allow the attacker to remotely change the configuration profile, a certificate, or the localization data used by AnyConnect Secure Mobility Client. Cisco Bug IDs: CSCvh23141.

CVSS v3 4.8 MEDIUM
CVSS v2.0 5.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/104430	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041075	Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-AnyConnect-cert-bypass	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.6\(100\):*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-06-07 21:29

Updated : 2023-12-10 12:30

NVD link : CVE-2018-0334

Mitre link : CVE-2018-0334

CVE.ORG link : CVE-2018-0334

JSON object : View

Products Affected

cisco

anyconnect_secure_mobility_client

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2018-0334", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}]}, "published": "2018-06-07T21:29:00.493", "references": [{"url": "http://www.securityfocus.com/bid/104430", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1041075", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-AnyConnect-cert-bypass", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConnect Secure Mobility Client for iOS, Mac OS X, Android, Windows, and Linux could allow an unauthenticated, remote attacker to bypass the TLS certificate check when downloading certain configuration files. The vulnerability is due to improper use of Simple Certificate Enrollment Protocol and improper server certificate validation. An attacker could exploit this vulnerability by preparing malicious profile and localization files for Cisco AnyConnect to use. A successful exploit could allow the attacker to remotely change the configuration profile, a certificate, or the localization data used by AnyConnect Secure Mobility Client. Cisco Bug IDs: CSCvh23141."}, {"lang": "es", "value": "Una vulnerabilidad en el subsistema de gesti\u00f3n de certificados de Cisco AnyConnect Network Access Manager y Cisco AnyConnect Secure Mobility Client para iOS, Mac OS X, Android, Windows y Linux podr\u00eda permitir que un atacante remoto no autenticado omita la comprobaci\u00f3n de certificados TLS al descargar ciertos archivos de configuraci\u00f3n. La vulnerabilidad se deba al uso incorrecto del protocolo Simple Certificate Enrollment y a una validaci\u00f3n incorrecta del certificado del servidor. Un atacante podr\u00eda explotar esta vulnerabilidad preparando archivos maliciosos del perfil y localizaci\u00f3n para que sean empleados por Cisco AnyConnect. Su explotaci\u00f3n con \u00e9xito podr\u00eda permitir que el atacante cambie remotamente el perfil de configuraci\u00f3n, un certificado o los datos de localizaci\u00f3n empleados por AnyConnect Secure Mobility Client. Cisco Bug IDs: CSCvh23141."}], "lastModified": "2019-10-09T23:31:48.037", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:anyconnect_secure_mobility_client:4.6\\(100\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC67D18A-5046-4069-A7BC-A84059C74F4E"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}