cisco-sa-20181107-imm-dos: Cisco Immunet and Cisco AMP for Endpoints System Scan Denial of Service Vulnerability
First published: Wed Nov 07 2018(Updated: )
A vulnerability in the system scanning component of Cisco Immunet and Cisco Advanced Malware Protection (AMP) for Endpoints running on Microsoft Windows could allow a local attacker to disable the scanning functionality of the product. This could allow executable files to be launched on the system without being analyzed for threats. The vulnerability is due to improper process resource handling. An attacker could exploit this vulnerability by gaining local access to a system running Microsoft Windows and protected by Cisco Immunet or Cisco AMP for Endpoints and executing a malicious file. A successful exploit could allow the attacker to prevent the scanning services from functioning properly and ultimately prevent the system from being protected from further intrusion. There are no workarounds that address this vulnerability.
Credit: John Page (hyp3rlinx) ApparitionSec
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Immunet | ||
| Cisco Advanced Malware Protection |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20181107-imm-dos?
The severity of cisco-sa-20181107-imm-dos is classified as high due to its potential impact on the scanning capabilities of the affected software.
How do I fix cisco-sa-20181107-imm-dos?
To mitigate cisco-sa-20181107-imm-dos, ensure that you update Cisco Immunet and Cisco Advanced Malware Protection to the latest versions provided by Cisco.
What products are affected by cisco-sa-20181107-imm-dos?
The products affected by cisco-sa-20181107-imm-dos are Cisco Immunet and Cisco Advanced Malware Protection (AMP) for Endpoints running on Microsoft Windows.
Who can exploit cisco-sa-20181107-imm-dos?
A local attacker with access to the system can exploit cisco-sa-20181107-imm-dos to disable the scanning functionality of the affected products.
What is the impact of cisco-sa-20181107-imm-dos?
The impact of cisco-sa-20181107-imm-dos can lead to unauthorized execution of files by disabling the malware scanning mechanism.
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/severity
- agent/weakness
- agent/title
- agent/references
- agent/author
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco immunet
- canonical/cisco advanced malware protection