cisco-secure-client

MEDIUM

maintainer dmsh 13 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt binary tarball (a Debian package containing compiled executables that run as a system service 'vpnagentd') from archive.org rather than from Cisco's official distribution channel. Archive.org is a third-party host where content can be uploaded by anyone and, critically, items can be silently replaced or modified by the uploader. While a sha256sum is provided, this only verifies the file hasn't changed since the maintainer last checked — it does not establish that the file came from Cisco or was not tampered with before being uploaded to archive.org. The installed binary runs as a privileged system daemon (systemctl enable --now vpnagentd.service), meaning any compromise in the binary would result in persistent root-level code execution. This is a genuine supply-chain concern: executed privileged binaries from an unofficial third-party host rather than the vendor's own infrastructure. The cheaper model's MEDIUM rating is correct.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 "https://archive.org/download/cisco-secure-client-linux64-${pkgver}/cisco-secure-client-linux64-${pkgver}-predeploy-deb-k9.tgz"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary tarball (a Debian package containing compiled executables that run as a system service 'vpnagentd') from archive.org rather than from Cisco's official distribution channel. Archive.org is a third-party host where content can be uploaded by anyone and, critically, items can be silently replaced or modified by the uploader. While a sha256sum is provided, this only verifies the file hasn't changed since the maintainer last checked — it does not establish that the file came from Cisco or was not tampered with before being uploaded to archive.org. The installed binary runs as a privileged system daemon (systemctl enable --now vpnagentd.service), meaning any compromise in the binary would result in persistent root-level code execution. This is a genuine supply-chain concern: executed privileged binaries from an unofficial third-party host rather than the vendor's own infrastructure. The cheaper model's MEDIUM rating is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Note: After installation must me enabled service 'sudo systemctl enable --now vpnagentd.service'
    
      2pkgname=cisco-secure-client
    
      3pkgver=5.1.17.3394
    
      4pkgrel=1
    
      5pkgdesc='Cisco AnyConnect Secure Mobility Client'
    
      6url='https://www.cisco.com/site/us/en/products/security/secure-client/index.html'
    
      7arch=('x86_64')
    
      8depends=('libxml2-legacy' 'ca-certificates')
    
      9optdepends=(
    
      10    'hicolor-icon-theme: required by desktop shortcuts'
    
      11    'glib2: required by vpnui'
    
      12    'gtk3: required by vpnui'
    
      13    'webkit2gtk: required by acwebhelper'
    
      14)
    
      15conflicts=('cisco-anyconnect')
    
      16license=('custom')
    
      17
    
      18# skip stripping the binaries to pass integrity check inside vpnagentd
    
      19options=('!strip')
    
      20
    
      21source=(
    
      22    "https://archive.org/download/cisco-secure-client-linux64-${pkgver}/cisco-secure-client-linux64-${pkgver}-predeploy-deb-k9.tgz"
    
      23)
    
      24
    
      25sha256sums=('5c4cafb4694e64cbf041481f5df3d70389399926f8aa2a469d480c0555b58c2c')
    
      26
    
      27prepare() {
    
      28    cd "$srcdir"
    
      29    bsdtar -xf "cisco-secure-client-vpn_${pkgver}_amd64.deb"
    
      30}
    
      31
    
      32package() {
    
      33    if [ -f "$srcdir"/data.tar.zst ]; then
    
      34        bsdtar -xf "$srcdir"/data.tar.zst -C "$pkgdir/"
    
      35    else
    
      36        bsdtar -xf "$srcdir"/data.tar.xz -C "$pkgdir/"
    
      37    fi
    
      38
    
      39    mv -f "$pkgdir/lib" "$pkgdir/usr"
    
      40}

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2