cisco-sa-famp-ZEpdXy: Cisco AMP for Endpoints and ClamAV Privilege Escalation Vulnerability
A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated, local attacker to cause the running software to delete arbitrary files on the system. The vulnerability is due to a race condition that could occur when scanning malicious files. An attacker with local shell access could exploit this vulnerability by executing a script that could trigger the race condition. A successful exploit could allow the attacker to delete arbitrary files on the system that the attacker would not normally have privileges to delete, producing system instability or causing the endpoint software to stop working. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-famp-ZEpdXy
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-famp-ZEpdXy?
The severity of cisco-sa-famp-ZEpdXy is classified as high due to the potential for arbitrary file deletion by an authenticated local attacker.
How do I fix cisco-sa-famp-ZEpdXy?
To mitigate the cisco-sa-famp-ZEpdXy vulnerability, it is recommended to update Cisco AMP for Endpoints and Clam AntiVirus to the latest versions provided by the vendor.
What products are affected by cisco-sa-famp-ZEpdXy?
cisco-sa-famp-ZEpdXy affects Cisco AMP for Endpoints and Clam AntiVirus software.
Can cisco-sa-famp-ZEpdXy be exploited remotely?
No, the cisco-sa-famp-ZEpdXy vulnerability requires an authenticated local attacker for exploitation.
What should I do if I am vulnerable to cisco-sa-famp-ZEpdXy?
If vulnerable to cisco-sa-famp-ZEpdXy, ensure that you apply the recommended software updates and review access controls to limit authenticated local access.