CVE-2017-3813 : Security Advisory and Response

A weakness in the Start Before Logon (SBL) module of Cisco AnyConnect Secure Mobility Client Software for Windows allows a local attacker to launch Internet Explorer with SYSTEM user privileges.

Understanding CVE-2017-3813

What is CVE-2017-3813?

The vulnerability in Cisco AnyConnect Secure Mobility Client Software for Windows versions prior to 4.4.00243 and 4.3.05017 allows unauthorized local attackers to exploit access control weaknesses.

The Impact of CVE-2017-3813

The vulnerability enables attackers to run Internet Explorer with SYSTEM user privileges, potentially executing privileged commands on the system.

Technical Details of CVE-2017-3813

Vulnerability Description

Insufficient access control implementation in the SBL module
Exploitable by opening Internet Explorer
Allows attackers to use Internet Explorer with SYSTEM user privileges
Impacts versions before 4.4.00243 and 4.3.05017

Affected Systems and Versions

Cisco AnyConnect Secure Mobility Client Software for Windows versions prior to 4.4.00243 and 4.3.05017

Exploitation Mechanism

Attackers exploit the vulnerability by launching Internet Explorer

Mitigation and Prevention

Immediate Steps to Take

Update to Cisco AnyConnect Secure Mobility Client Software versions 4.4.00243 or 4.3.05017
Monitor for any unauthorized system access

Long-Term Security Practices

Implement least privilege access controls
Regularly update software and security patches

Patching and Updates

Apply patches provided by Cisco to address the vulnerability