CVE-2019-1853 Cisco AnyConnect Secure Mobility Client for Linux Out-of-Bounds Memory Read Vulnerability
Remote attackers can read sensitive information from Linux systems running Cisco AnyConnect via crafted HTTP traffic due to improper bounds checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-1853?
CVE-2019-1853 is a medium-severity vulnerability in Cisco Anyconnect Secure Mobility Client, published on 16 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the HostScan component of Cisco AnyConnect Secure Mobility Client for Linux could allow an unauthenticated, remote attacker to read sensitive information on an affected system. The vulnerability exists because the affected software performs improper bounds checks. An attacker could exploit this vulnerability by crafting HTTP traffic for the affected component to download and process. A successful exploit could allow the attacker to read sensitive information on the affected system.
Weakness: CWE-125
Which versions are affected by CVE-2019-1853?
It affects 1 product.
Products include Cisco Anyconnect Secure Mobility Client.
How do I fix CVE-2019-1853?
No fix has been published for CVE-2019-1853 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-1853 being exploited?
There is no known exploitation of CVE-2019-1853 in the wild and no public exploit code.
Other vulnerabilities in Cisco Anyconnect Secure Mobility Client
Sources
Also known as GHSA-g45c-cv5h-jw66.