CVE-2010-0589 (GCVE-0-2010-0589)

Vulnerability from cvelistv5 – Published: 2010-04-15 17:00 – Updated: 2024-08-07 00:52
VLAI?
Summary
The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T00:52:19.797Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20100414 Cisco Secure Desktop ActiveX Control Code Execution Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.zerodayinitiative.com/advisories/ZDI-10-072/"
          },
          {
            "name": "39478",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/39478"
          },
          {
            "name": "cisco-csdwebinstaller-code-execution(57812)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57812"
          },
          {
            "name": "1023881",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1023881"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-04-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-16T14:57:01",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20100414 Cisco Secure Desktop ActiveX Control Code Execution Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.zerodayinitiative.com/advisories/ZDI-10-072/"
        },
        {
          "name": "39478",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/39478"
        },
        {
          "name": "cisco-csdwebinstaller-code-execution(57812)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57812"
        },
        {
          "name": "1023881",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1023881"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2010-0589",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20100414 Cisco Secure Desktop ActiveX Control Code Execution Vulnerability",
              "refsource": "CISCO",
              "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml"
            },
            {
              "name": "http://www.zerodayinitiative.com/advisories/ZDI-10-072/",
              "refsource": "MISC",
              "url": "http://www.zerodayinitiative.com/advisories/ZDI-10-072/"
            },
            {
              "name": "39478",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/39478"
            },
            {
              "name": "cisco-csdwebinstaller-code-execution(57812)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57812"
            },
            {
              "name": "1023881",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1023881"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2010-0589",
    "datePublished": "2010-04-15T17:00:00",
    "dateReserved": "2010-02-10T00:00:00",
    "dateUpdated": "2024-08-07T00:52:19.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:secure_desktop:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"3.5\", \"matchCriteriaId\": \"0B5E0489-A3D0-4FA8-BF36-7C329090F075\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:secure_desktop:3.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6EE6B79A-FD31-4637-BE22-EEADF63B94FF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:secure_desktop:3.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F2F8EA5-8DEF-48D0-9E7F-6047D4AECC5C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:secure_desktop:3.1.1.27:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"59D841B0-3D1B-4F1C-87F1-D0355955E49C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:secure_desktop:3.1.1.33:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F13E414E-E56E-496E-A952-F93DCF1B1BDC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:secure_desktop:3.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0D7A8878-2E0F-4140-86DF-75999B47E4F5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:secure_desktop:3.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4932BA9E-4156-4445-93E9-7A9F1D81090B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:secure_desktop:3.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3497EB29-C406-44C1-AB28-0DDC4E79A9D9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:secure_desktop:3.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6C63D54D-6424-4767-9832-41E7F0B1D1E9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:secure_desktop:3.4.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F4D4CF6F-2F81-45B0-9B5B-C8D79E74D6F4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:secure_desktop:3.4.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AA0286A4-6011-41DF-B607-44CFBBFD437F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:cisco:secure_desktop:3.4.2048:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FE277431-4101-4C0F-91DB-A1C15C0344FF\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876.\"}, {\"lang\": \"es\", \"value\": \"El control ActiveX Web Install ActiveX en Cisco Secure Desktop (CSD) anterior a v3.5.841, no verifica adecuadamente las firmas de los programas descargados, lo que permite a atacantes remotos forzar las descargas y ejecuciones de archivos de su elecci\\u00f3n a trav\\u00e9s de una p\\u00e1gina web manipulada. Tambi\\u00e9n conocido con el Bug ID CSCta25876.\"}]",
      "id": "CVE-2010-0589",
      "lastModified": "2024-11-21T01:12:30.760",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:C/I:C/A:C\", \"baseScore\": 9.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 8.6, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2010-04-15T17:30:00.523",
      "references": "[{\"url\": \"http://securitytracker.com/id?1023881\", \"source\": \"ykramarz@cisco.com\"}, {\"url\": \"http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml\", \"source\": \"ykramarz@cisco.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/39478\", \"source\": \"ykramarz@cisco.com\"}, {\"url\": \"http://www.zerodayinitiative.com/advisories/ZDI-10-072/\", \"source\": \"ykramarz@cisco.com\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/57812\", \"source\": \"ykramarz@cisco.com\"}, {\"url\": \"http://securitytracker.com/id?1023881\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/39478\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.zerodayinitiative.com/advisories/ZDI-10-072/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/57812\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "ykramarz@cisco.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2010-0589\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2010-04-15T17:30:00.523\",\"lastModified\":\"2025-04-11T00:51:21.963\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876.\"},{\"lang\":\"es\",\"value\":\"El control ActiveX Web Install ActiveX en Cisco Secure Desktop (CSD) anterior a v3.5.841, no verifica adecuadamente las firmas de los programas descargados, lo que permite a atacantes remotos forzar las descargas y ejecuciones de archivos de su elecci\u00f3n a trav\u00e9s de una p\u00e1gina web manipulada. Tambi\u00e9n conocido con el Bug ID CSCta25876.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:C/I:C/A:C\",\"baseScore\":9.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.6,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:secure_desktop:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.5\",\"matchCriteriaId\":\"0B5E0489-A3D0-4FA8-BF36-7C329090F075\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:secure_desktop:3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6EE6B79A-FD31-4637-BE22-EEADF63B94FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:secure_desktop:3.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F2F8EA5-8DEF-48D0-9E7F-6047D4AECC5C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:secure_desktop:3.1.1.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59D841B0-3D1B-4F1C-87F1-D0355955E49C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:secure_desktop:3.1.1.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F13E414E-E56E-496E-A952-F93DCF1B1BDC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:secure_desktop:3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D7A8878-2E0F-4140-86DF-75999B47E4F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:secure_desktop:3.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4932BA9E-4156-4445-93E9-7A9F1D81090B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:secure_desktop:3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3497EB29-C406-44C1-AB28-0DDC4E79A9D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:secure_desktop:3.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6C63D54D-6424-4767-9832-41E7F0B1D1E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:secure_desktop:3.4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4D4CF6F-2F81-45B0-9B5B-C8D79E74D6F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:secure_desktop:3.4.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AA0286A4-6011-41DF-B607-44CFBBFD437F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:secure_desktop:3.4.2048:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE277431-4101-4C0F-91DB-A1C15C0344FF\"}]}]}],\"references\":[{\"url\":\"http://securitytracker.com/id?1023881\",\"source\":\"psirt@cisco.com\"},{\"url\":\"http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/39478\",\"source\":\"psirt@cisco.com\"},{\"url\":\"http://www.zerodayinitiative.com/advisories/ZDI-10-072/\",\"source\":\"psirt@cisco.com\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/57812\",\"source\":\"psirt@cisco.com\"},{\"url\":\"http://securitytracker.com/id?1023881\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/39478\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.zerodayinitiative.com/advisories/ZDI-10-072/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/57812\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.