Description
Cisco VPN Client on Windows before 5.0.01.0600, and the 5.0.01.0600 InstallShield (IS) release, uses weak permissions for cvpnd.exe (Modify granted to Interactive Users), which allows local users to gain privileges via a modified cvpnd.exe.
References
- 20070816 Local privilege escalation vulnerability in Cisco VPN client mailing-list
- 20070815 Local Privilege Escalation Vulnerabilities in Cisco VPN Client vendor-advisory
- ADV-2007-2903 vdb-entry
- 3023 third-party-advisory
- 26459 third-party-advisory
- 25332 vdb-entry
- 1018573 vdb-entry
- cisco-vpn-cvpnd-privilege-escalation(36032) vdb-entry