HTTP: Cisco Secure Desktop CSDWebInstaller ActiveX Code Execution
This signature detects attempts to use unsafe ActiveX controls in Cisco Secure Desktop. An attacker can create a malicious Web site containing Web pages with dangerous ActiveX controls, which if accessed by a victim, allows the attacker to gain control of the victim's client browser or result in arbitrary code execution.
Extended Description
A Cisco Secure Desktop is prone to a vulnerability that can cause malicious files to be downloaded and saved to arbitrary locations on an affected computer. Attackers may exploit this issue to put malicious files in arbitrary locations on a victim's computer. Successful exploits will allow attackers to execute arbitrary code within the context of the currently logged-in user.
Affected Products
Cisco secure_desktop
Short Name
HTTP:STC:ACTIVEX:CISCO-CSD-WEB
Severity
Major
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
ActiveX CSDWebInstaller CVE-2011-0926 Cisco Code Desktop Execution Secure bid:46536
Release Date
03/31/2011
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3659
False Positive
Unknown
Vendors
Cisco
CVSS Score
9.3