A vulnerability has been reported in Cisco VPN Client, which can be exploited by malicious, local users to gain escalated privileges on a vulnerable system.

The vulnerability is caused due to an error in the GUI (also known as the "VPN client dialer") in combination with the "Start Before Logon" feature, which can be enabled by unprivileged users. This can be exploited to execute arbitrary commands with SYSTEM privileges.

The vulnerability has been reported in versions 2.x, 3.x, 4.0.x, 4.6.x, 4.7.x (except version 4.7.00.0533), and 4.8.00.x for Windows.

Solution
Update to version 4.8.01.0300.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits:
* Andrew Christensen, FortConsult.
* Johan Ronkainen

Changelog
Further details available in Customer Area

Original Advisory
http://www.cisco.com/warp/public/707/cisco-sa-20060524-vpnclient.shtml

Deep Links
Links available in Customer Area