Hostscan Is Waiting For The Next Scan Macos

2015-12-05 02:24:13 UTC

Second Password: notice: Hostscan is performing system scan notice: Hostscan is performing software scan notice: Hostscan state idle notice: Hostscan is waiting for the next scan Login failed. Symptom: A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the AnyConnect client.

Hello openconnect team,
Here is a quick summary of what I've sent previously:
My company doesn't official support Linux when connecting to a Cisco
Anywhere VPN. I'm told if I can get it to work, it is fine, but they are
not going to support me. So, what I've done is I referenced this thread
between David and Fromzy:
(switch to http)
hxxp://openconnect-devel.infradead.narkive.com/HaRKFi2f/csd-use-and-impossib
le-to-connect-linux
The problem I was having is openconnect would fail to continue if the CSD
could not be downloaded. This is what the log showed:
GET hxxps://vpn.company.com/CACHE/sdesktop/install/binaries/sfinst
Got HTTP response: HTTP/1.1 404 Not Found (does not exist)
X-Transcend-Version: 1
HTTP body http 1.0 (-1)
Cannot receive HTTP 1.0 body without closing connection Failed to obtain
WebVPN cookie
I original directly modified the code to skip the download but later found
out that I could simply use 'os=android' on the command line. Once I got
past that I ended up using sslsplit and capturing a windows session
connecting. I then basically ran Curl in the wrapper script using these
post values:
run_curl --data-ascii @-
'https://$CSD_HOSTNAME/+CSCOE+/sdesktop/scan.xml?reusebrowser=1' <<-END
endpoint.policy.location='Default';
endpoint.enforce='success';
endpoint.fw['MSWindowsFW']={};
endpoint.fw['MSWindowsFW'].exists='true';
endpoint.fw['MSWindowsFW'].enabled='ok';
endpoint.as['MicrosoftAS']={};
endpoint.as['MicrosoftAS'].exists='true';
endpoint.as['MicrosoftAS'].activescan='ok';
endpoint.av['MicrosoftAV']={};
endpoint.av['MicrosoftAV'].exists='true';
endpoint.av['MicrosoftAV'].activescan='ok';
END
I got two other co-workers hook up this way as well and we are all
successfully able to connect now. I'm having my co-workers use the
'--os-android' flag, but I question if this isn't going to lead to other
issues in the future. All, I want to do is continue if the CSD failed to
download or skip it altogether.
What I'd like to eventually do is put together a tutorial for other Linux
users who are stuck. I spent a long time getting this to work and I think
others might find it useful.
My next goal is to get this to work with network-manager but I'm still stuck
on how to correctly update the version of openconnect it uses and how to
pass in optional commandline arguments.
For now do you think it would make sense to add in a new commandline
argument? Maybe something like '--csd-skip-download'? I'm fine continuing
to use '--os=android', but it seems a bit odd.
I can reply to this thread sometime in the future once I complete my
tutorial.
Thanks
--Andy

I have a user who is unable to login using AnyConnect. Their screen hangs at the AnyConnect message: “Hostscan is waiting for the next scan”.

Looking at the logs on the ASA I saw the following log:

Next

Jun 25 2014 16:25:21: %ASA-3-716600: Rejected 266KB Hostscan data from IP <10.5.1.50>. Hostscan results exceed default limit of 200KB.

Waiting

The syslog database says to increase the limit I need to contact Cisco TAC. So I did.

Hostscan Is Waiting For The Next Scan Mac

Cisco TAC gave me the following commands which fixed the issue:

Hostscan Is Waiting For The Next Scan Macos Version

Additional questions I asked Cisco but there was no answer:

Hostscan Is Waiting For The Next Scan Macos Catalina

Hostscan Is Waiting For The Next Scan Macos

Hostscan Is Waiting For The Next Scan Macos Download

  • Why is this a secret command?
  • My current hostscan only checks one registry string. Why is it generating more than 200KB of data for this?
  • Why is the default setting not good enough?
  • Why is this only happening for some users?