+---------------------------------------
To determine which version of the Cisco VPN Client is running on a
Microsoft Windows machine, follow the following steps:
1. Select "Programs->Cisco Systems VPN Client->VPN Client" from the Start
menu. This action will open the Cisco VPN Client graphical user
interface.
2. Select the option "About VPN Client..." from the "Help" menu. This
menu option will display a dialog box that contains text similar to
"Cisco Systems VPN Client Version 4.8.01.0300."
It is possible to work around this vulnerability without a software upgrade.
The permissions applied to the file by default are shown below:
C:\ >cacls "C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe"
C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
BUILTIN\Users:R
BUILTIN\Administrators:F
High Risk Vulnerability in Cisco VPN client (Windows 64 bit)
25 March 2011
Gavin Jones of NGS Secure has discovered a High risk vulnerability in the Cisco VPN client (Windows 64 bit).
Impact: Privilege Escalation
Cisco has released a patch that addresses the issue. The announcement of this patch can be found here:
Products Confirmed Not Vulnerable
+--------------------------------
The Cisco AnyConnect Secure Mobility Client for Apple iOS and the
IPsec-only Cisco VPN Client are not affected by these
vulnerabilities.
No other Cisco products are currently known to be affected by these
vulnerabilities.
=================
Technical Details
=================
Cisco's VPN client for Windows installs a Windows service, the "Cisco
Systems, Inc. VPN Service" or CVPND, whose associated binary is
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe. By default, the
CVPND service runs as Local System.
SERVICE_NAME: CVPND
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
Cisco IOS devices that are not configured for cTCP are not affected
by this vulnerability. The Cisco ASA and Cisco VPN 3000 series
concentrators are not vulnerable. Cisco IOS devices configured as
EZVPN clients are not affected by this vulnerability. The Cisco VPN
Client is not vulnerable. Cisco IOS-XR and Cisco IOS-XE software are
not affected by this vulnerability. No other Cisco products are
currently known to be affected by this vulnerability.
Details
=======
