cisco-sa-20190703-amp-commandinj: Cisco Advanced Malware Protection for Endpoints Windows Command Injection Vulnerability
First published: Wed Jul 03 2019(Updated: )
A vulnerability in Cisco Advanced Malware Protection (AMP) for Endpoints for Windows could allow an authenticated, local attacker with administrator privileges to execute arbitrary code. The vulnerability is due to insufficient validation of dynamically loaded modules. An attacker could exploit this vulnerability by placing a file in a specific location in the Windows filesystem. A successful exploit could allow the attacker to execute the code with the privileges of the AMP service. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-amp-commandinj
Credit: Edsel Valle NSS Labs
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Advanced Malware Protection |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20190703-amp-commandinj?
The severity of cisco-sa-20190703-amp-commandinj is critical due to the potential for arbitrary code execution.
How do I fix cisco-sa-20190703-amp-commandinj?
To fix cisco-sa-20190703-amp-commandinj, update Cisco Advanced Malware Protection to the latest version that addresses this vulnerability.
Who is affected by cisco-sa-20190703-amp-commandinj?
The cisco-sa-20190703-amp-commandinj vulnerability affects administrators using Cisco Advanced Malware Protection for Endpoints on Windows.
What causes cisco-sa-20190703-amp-commandinj?
cisco-sa-20190703-amp-commandinj is caused by insufficient validation of dynamically loaded modules within Cisco Advanced Malware Protection.
Can an attacker exploit cisco-sa-20190703-amp-commandinj remotely?
No, an attacker must have local access and administrator privileges to exploit cisco-sa-20190703-amp-commandinj.
- agent/type
- agent/event
- collector/cisco-advisory
- source/Cisco
- agent/weakness
- agent/author
- agent/severity
- agent/title
- agent/references
- agent/last-modified-date
- agent/first-publish-date
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco advanced malware protection