Information Disclosure Vulnerability in Cisco Secure Desktop SSL VPN Client

CVE-2006-5806

Summary

The Cisco Secure Desktop SSL VPN Client, prior to version 3.1.1.45, exhibits a security flaw when configured to launch a web browser following a successful VPN connection. This flaw results in the storage of sensitive browser session data in a directory that exists outside of the CSD vault. Consequently, users may save files outside of the vault, allowing potential access to unencrypted data even after the VPN session ends. Local users are therefore capable of reading this sensitive information, posing a significant security risk.

References