CVE:CVE-2007-1066
CNNVD:CNNVD-200702-366
Cisco Secure Services Client是一种用于在多个Cisco设备中布署单一基于802.1X认证框架的工具。
Cisco Secure Services Client和终端主机上所安装的Cisco Trust Agent的实现上存在多个漏洞，本地攻击者可能利用这些漏洞获取非授权访问或敏感信息。连接客户端GUI(ConnectionClient.exe)不安全的任意访问控制列表(DACL)允许非特权用户在以SYSTEM级权限运行的ConnectionClient.exe下注入线程。这个漏洞记录为CiscoBug ID CSCsg20558。
solution:Upgrade cisco secure_services_client to a higher version than 4.0,4.0.5,4.0.51,and avoid the version 4.0,4.0.5,4.0.51; Upgrade cisco security_agent to a higher version than 5.0,5.1,and avoid the version 5.0,5.1; Upgrade cisco trust_agent to a higher version than 1.0,2.0,2.0.1,2.1,and avoid the version 1.0,2.0,2.0.1,2.1; Upgrade meetinghouse aegis_secureconnect_client to a higher version than windows_platform,and avoid the version windows_platform