cisco-sa-amp-imm-dll-tu79hvkO: Cisco Advanced Malware Protection for Endpoints Windows Connector, ClamAV for Windows, and Immunet DLL Hijacking Vulnerability
First published: Wed Apr 07 2021(Updated: )
A vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector, ClamAV for Windows, and Immunet could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected Windows system. To exploit this vulnerability, the attacker would need valid credentials on the system. The vulnerability is due to insufficient validation of directory search paths at run time. An attacker could exploit this vulnerability by placing a malicious DLL file on an affected system. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-amp-imm-dll-tu79hvkO
Credit: Kyriakos Economou ZeroPeril LtdTom Wilson ZeroPeril Ltd
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Products | =ClamAV for Windows<0.103.2=Cisco AMP for Endpoints for Windows<7.3.15 | 0.103.2 7.3.15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-amp-imm-dll-tu79hvkO?
The vulnerability identified as cisco-sa-amp-imm-dll-tu79hvkO has been rated with high severity due to its potential for DLL hijacking.
How do I fix cisco-sa-amp-imm-dll-tu79hvkO?
To remediate the cisco-sa-amp-imm-dll-tu79hvkO vulnerability, upgrade Cisco Advanced Malware Protection (AMP) for Endpoints and ClamAV for Windows to the latest versions provided by Cisco.
Who is affected by cisco-sa-amp-imm-dll-tu79hvkO?
The cisco-sa-amp-imm-dll-tu79hvkO vulnerability affects authenticated users of Cisco AMP for Endpoints on Windows and ClamAV for Windows.
What type of attack can cisco-sa-amp-imm-dll-tu79hvkO facilitate?
The cisco-sa-amp-imm-dll-tu79hvkO vulnerability can facilitate a DLL hijacking attack, allowing attackers to execute arbitrary code.
Is cisco-sa-amp-imm-dll-tu79hvkO remotely exploitable?
The cisco-sa-amp-imm-dll-tu79hvkO vulnerability is not remotely exploitable as it requires local access and authentication.
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/title
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/cisco-advisory
- source/Cisco
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco products
- version/cisco products/clamav for windows
- version/cisco products/cisco amp for endpoints for windows