CVE-2010-0589 The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force th...
HighCVSS 9.3
EPSS 4.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco secure desktop | <= 3.5 | No fix listed |
| cisco secure desktop | = 3.1 | No fix listed |
| cisco secure desktop | = 3.1.1 | No fix listed |
| cisco secure desktop | = 3.1.1.27 | No fix listed |
| cisco secure desktop | = 3.1.1.33 | No fix listed |
| cisco secure desktop | = 3.2 | No fix listed |
| cisco secure desktop | = 3.2.1 | No fix listed |
| cisco secure desktop | = 3.3 | No fix listed |
| cisco secure desktop | = 3.4 | No fix listed |
| cisco secure desktop | = 3.4.1 | No fix listed |
| cisco secure desktop | = 3.4.2 | No fix listed |
| cisco secure desktop | = 3.4.2048 | No fix listed |
References
- 1023881 vdb-entry
- 20100414 Cisco Secure Desktop ActiveX Control Code Execution Vulnerability patch vendor-advisory
- 39478 vdb-entry
- www.zerodayinitiative.com
- cisco-csdwebinstaller-code-execution(57812) vdb-entry