Cisco Secure Desktop ActiveX Control Code Execution Vulnerability
21 Jun. 2010
Summary
Cisco Secure Desktop contains a vulnerable ActiveX control that could allow an attacker to execute arbitrary code with the privileges of the user who is currently logged into the affected system.
Vulnerable Systems:
* Cisco Secure Desktop versions prior to 3.5.841
A Cisco-signed ActiveX control that is used by Cisco Secure Desktop fails to properly verify the integrity of an executable file that is used by the Cisco Secure Desktop installation process. If an attacker can entice a user to visit an attacker controlled web page, the vulnerable ActiveX control could be invoked to download an attacker-modified package. The package could contain a malicious executable file that executes with the privileges of the affected user. A successful exploit could result in a complete compromise of a vulnerable system.
Successful exploitation of this vulnerability could result in a complete compromise of the affected system.
Workaround:
Administrators can mitigate this vulnerability by using the kill bit feature of Microsoft Windows to prevent the loading and execution of the vulnerable ActiveX control. Administrators must use the Class identifier (CLSID) of the vulnerable ActiveX control to disable the control. The affected CLSID is:
705EC6D4-B138-4079-A307-EF13E4889A82
Instructions for setting the kill bit in Microsoft Windows are available at the following link:
Note: Kill bit settings are permanent. The settings must be removed to regain Cisco Secure Desktop functionality. After an administrator has updated the Cisco Secure Desktop software to a fixed version on VPN portal devices, the kill bit must be removed from Microsoft Windows clients in order to allow the Cisco Secure Desktop software to be upgraded. Once the kill bit is removed, clients may be vulnerable until a fixed Cisco Secure Desktop version is installed.
Additional mitigation techniques that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory:
