CVE-2009-4118

Currently unrated

Key Information:

Vendor
Cisco
Status
Vpn Client
Vendor
CVE Published:
1 December 2009

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The StartServiceCtrlDispatcher function in the cvpnd service (cvpnd.exe) in Cisco VPN client for Windows before 5.0.06.0100 does not properly handle an ERROR_FAILED_SERVICE_CONTROLLER_CONNECT error, which allows local users to cause a denial of service (service crash and VPN connection loss) via a manual start of cvpnd.exe while the cvpnd service is running.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2009-4118
Created by alt3kx

References

http://secunia.com/advisories/37419
third-party-advisoryx_refsource_SECUNIA
http://packetstormsecurity.org/0911-exploits/sybsec-adv17...
x_refsource_MISC
http://www.vupen.com/english/advisories/2009/3296
vdb-entryx_refsource_VUPEN

Timeline

  • Vulnerability Reserved

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

.