cisco-sa-famp-ZEpdXy: Cisco AMP for Endpoints and ClamAV Privilege Escalation Vulnerability
First published: Wed Jun 17 2020(Updated: )
A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated, local attacker to cause the running software to delete arbitrary files on the system. The vulnerability is due to a race condition that could occur when scanning malicious files. An attacker with local shell access could exploit this vulnerability by executing a script that could trigger the race condition. A successful exploit could allow the attacker to delete arbitrary files on the system that the attacker would not normally have privileges to delete, producing system instability or causing the endpoint software to stop working. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-famp-ZEpdXy
Credit: This vulnerability was discovered when reviewing a publication by RACK911 on exploiting antivirus by using directory junctions symlinks.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Advanced Malware Protection for Endpoints | ||
| ClamAV |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-famp-ZEpdXy?
The severity of cisco-sa-famp-ZEpdXy is classified as high due to the potential for arbitrary file deletion by an authenticated local attacker.
How do I fix cisco-sa-famp-ZEpdXy?
To mitigate the cisco-sa-famp-ZEpdXy vulnerability, it is recommended to update Cisco AMP for Endpoints and Clam AntiVirus to the latest versions provided by the vendor.
What products are affected by cisco-sa-famp-ZEpdXy?
cisco-sa-famp-ZEpdXy affects Cisco AMP for Endpoints and Clam AntiVirus software.
Can cisco-sa-famp-ZEpdXy be exploited remotely?
No, the cisco-sa-famp-ZEpdXy vulnerability requires an authenticated local attacker for exploitation.
What should I do if I am vulnerable to cisco-sa-famp-ZEpdXy?
If vulnerable to cisco-sa-famp-ZEpdXy, ensure that you apply the recommended software updates and review access controls to limit authenticated local access.
- agent/event
- agent/author
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/weakness
- agent/title
- agent/severity
- agent/references
- agent/description
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco advanced malware protection for endpoints
- vendor/clamav
- canonical/clamav