cisco-secure-client

maintainer dmsh · 11 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary tarball (a Debian package containing compiled executables that run as a system service 'vpnagentd') from archive.org rather than from Cisco's official distribution channel. Archive.org is a third-party host where content can be uploaded by anyone and, critically, items can be silently replaced or modified by the uploader. While a sha256sum is provided, this only verifies the file hasn't changed since the maintainer last checked — it does not establish that the file came from Cisco or was not tampered with before being uploaded to archive.org. The installed binary runs as a privileged system daemon (systemctl enable --now vpnagentd.service), meaning any compromise in the binary would result in persistent root-level code execution. This is a genuine supply-chain concern: executed privileged binaries from an unofficial third-party host rather than the vendor's own infrastructure. The cheaper model's MEDIUM rating is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 "https://archive.org/download/cisco-secure-client-linux64-${pkgver}/cisco-secure-client-linux64-${pkgver}-predeploy-deb-k9.tgz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary tarball (a Debian package containing compiled executables that run as a system service 'vpnagentd') from archive.org rather than from Cisco's official distribution channel. Archive.org is a third-party host where content can be uploaded by anyone and, critically, items can be silently replaced or modified by the uploader. While a sha256sum is provided, this only verifies the file hasn't changed since the maintainer last checked — it does not establish that the file came from Cisco or was not tampered with before being uploaded to archive.org. The installed binary runs as a privileged system daemon (systemctl enable --now vpnagentd.service), meaning any compromise in the binary would result in persistent root-level code execution. This is a genuine supply-chain concern: executed privileged binaries from an unofficial third-party host rather than the vendor's own infrastructure. The cheaper model's MEDIUM rating is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Note: After installation must me enabled service 'sudo systemctl enable --now vpnagentd.service'
    
      2pkgname=cisco-secure-client
    
      3pkgver=5.1.17.3394
    
      4pkgrel=1
    
      5pkgdesc='Cisco AnyConnect Secure Mobility Client'
    
      6url='https://www.cisco.com/site/us/en/products/security/secure-client/index.html'
    
      7arch=('x86_64')
    
      8depends=('libxml2-legacy' 'ca-certificates')
    
      9optdepends=(
    
      10    'hicolor-icon-theme: required by desktop shortcuts'
    
      11    'glib2: required by vpnui'
    
      12    'gtk3: required by vpnui'
    
      13    'webkit2gtk: required by acwebhelper'
    
      14)
    
      15conflicts=('cisco-anyconnect')
    
      16license=('custom')
    
      17
    
      18# skip stripping the binaries to pass integrity check inside vpnagentd
    
      19options=('!strip')
    
      20
    
      21source=(
    
      22    "https://archive.org/download/cisco-secure-client-linux64-${pkgver}/cisco-secure-client-linux64-${pkgver}-predeploy-deb-k9.tgz"
    
      23)
    
      24
    
      25sha256sums=('5c4cafb4694e64cbf041481f5df3d70389399926f8aa2a469d480c0555b58c2c')
    
      26
    
      27prepare() {
    
      28    cd "$srcdir"
    
      29    bsdtar -xf "cisco-secure-client-vpn_${pkgver}_amd64.deb"
    
      30}
    
      31
    
      32package() {
    
      33    if [ -f "$srcdir"/data.tar.zst ]; then
    
      34        bsdtar -xf "$srcdir"/data.tar.zst -C "$pkgdir/"
    
      35    else
    
      36        bsdtar -xf "$srcdir"/data.tar.xz -C "$pkgdir/"
    
      37    fi
    
      38
    
      39    mv -f "$pkgdir/lib" "$pkgdir/usr"
    
      40}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2