March 8, 2024 at 03:45AM
Cisco has addressed a high-severity security flaw in its Secure Client software, known as CVE-2024-20337, which could be exploited for a VPN session with a targeted user. A successful exploit could permit an attacker to execute arbitrary script code in the browser. Another high-severity flaw in Secure Client for Linux, CVE-2024-20338, has also been resolved.
Key takeaways from the meeting notes on Newsroom Network Security / Vulnerability:
– Cisco has released patches to address a high-severity security flaw impacting its Secure Client software, with the vulnerability being tracked as CVE-2024-20337 (CVSS score: 8.2).
– The vulnerability allows an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF) injection attack against a user, potentially leading to the execution of arbitrary script code in the browser or access to sensitive, browser-based information.
– The impacted versions are Secure Client for Windows, Linux, and macOS. The vulnerability has been addressed in specific versions for each platform, with recommended actions for each version.
– The flaw was discovered and reported by Amazon security researcher Paulos Yibelo Mesfin, who highlighted that it allows attackers to access local internal networks when a target visits a website under their control.
– Additionally, Cisco has published fixes for CVE-2024-20338, another high-severity flaw in Secure Client for Linux, which has been resolved in version 5.1.2.42.
These takeaways provide a clear understanding of the security vulnerability and the actions taken to address it.