PT-2015-7566

CVE-2015-7600

·

Published

2015-10-06

·

Updated

2017-01-05

Description by

CVSS 2.0
7.2
High
MetricsAV:L/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Cisco VPN Client versions 5.x through 5.0.07.0440
Description The issue allows local users to gain privileges by entering an arbitrary program name in the Command field of the ApplicationLauncher section in the vpnclient.ini file, due to weak permissions used by the software.
Recommendations For versions 5.x through 5.0.07.0440, consider restricting access to the vpnclient.ini file to prevent local users from modifying the ApplicationLauncher section until a fix is available.
Exploitability
Exploit
Fix
Vendors
Affected products
Weakness enumeration
CWE-264
Related identifiers
CVE-2015-7600
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com