{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2010-04-14T00:00:00", "descriptions": [{"lang": "en", "value": "The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-16T14:57:01", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco"}, "references": [{"name": "20100414 Cisco Secure Desktop ActiveX Control Code Execution Vulnerability", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml"}, {"tags": ["x_refsource_MISC"], "url": "http://www.zerodayinitiative.com/advisories/ZDI-10-072/"}, {"name": "39478", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/39478"}, {"name": "cisco-csdwebinstaller-code-execution(57812)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57812"}, {"name": "1023881", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1023881"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@cisco.com", "ID": "CVE-2010-0589", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20100414 Cisco Secure Desktop ActiveX Control Code Execution Vulnerability", "refsource": "CISCO", "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml"}, {"name": "http://www.zerodayinitiative.com/advisories/ZDI-10-072/", "refsource": "MISC", "url": "http://www.zerodayinitiative.com/advisories/ZDI-10-072/"}, {"name": "39478", "refsource": "BID", "url": "http://www.securityfocus.com/bid/39478"}, {"name": "cisco-csdwebinstaller-code-execution(57812)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57812"}, {"name": "1023881", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1023881"}]}}}}, "cveMetadata": {"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2010-0589", "datePublished": "2010-04-15T17:00:00", "dateReserved": "2010-02-10T00:00:00", "dateUpdated": "2017-08-16T14:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:secure_desktop:*:*:*:*:*:*:*:*", "matchCriteriaId": "0B5E0489-A3D0-4FA8-BF36-7C329090F075", "versionEndIncluding": "3.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.1:*:*:*:*:*:*:*", "matchCriteriaId": "6EE6B79A-FD31-4637-BE22-EEADF63B94FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "7F2F8EA5-8DEF-48D0-9E7F-6047D4AECC5C", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.1.1.27:*:*:*:*:*:*:*", "matchCriteriaId": "59D841B0-3D1B-4F1C-87F1-D0355955E49C", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.1.1.33:*:*:*:*:*:*:*", "matchCriteriaId": "F13E414E-E56E-496E-A952-F93DCF1B1BDC", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.2:*:*:*:*:*:*:*", "matchCriteriaId": "0D7A8878-2E0F-4140-86DF-75999B47E4F5", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "4932BA9E-4156-4445-93E9-7A9F1D81090B", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.3:*:*:*:*:*:*:*", "matchCriteriaId": "3497EB29-C406-44C1-AB28-0DDC4E79A9D9", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.4:*:*:*:*:*:*:*", "matchCriteriaId": "6C63D54D-6424-4767-9832-41E7F0B1D1E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "F4D4CF6F-2F81-45B0-9B5B-C8D79E74D6F4", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "AA0286A4-6011-41DF-B607-44CFBBFD437F", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:secure_desktop:3.4.2048:*:*:*:*:*:*:*", "matchCriteriaId": "FE277431-4101-4C0F-91DB-A1C15C0344FF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876."}, {"lang": "es", "value": "El control ActiveX Web Install ActiveX en Cisco Secure Desktop (CSD) anterior a v3.5.841, no verifica adecuadamente las firmas de los programas descargados, lo que permite a atacantes remotos forzar las descargas y ejecuciones de archivos de su elecci\u00f3n a trav\u00e9s de una p\u00e1gina web manipulada. Tambi\u00e9n conocido con el Bug ID CSCta25876."}], "id": "CVE-2010-0589", "lastModified": "2017-08-17T01:32:02.523", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2010-04-15T17:30:00.523", "references": [{"source": "ykramarz@cisco.com", "url": "http://securitytracker.com/id?1023881"}, {"source": "ykramarz@cisco.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml"}, {"source": "ykramarz@cisco.com", "url": "http://www.securityfocus.com/bid/39478"}, {"source": "ykramarz@cisco.com", "url": "http://www.zerodayinitiative.com/advisories/ZDI-10-072/"}, {"source": "ykramarz@cisco.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57812"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}