PT-2018-1782 · Cisco+1 · Cisco Advanced Malware Protection (Amp) For Endpoints+2

Hyp3Rlinx + 1 · Published 2018-11-07 · Updated 2020-09-16 · CVE-2018-15437

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Immunet and Cisco Advanced Malware Protection (AMP) for Endpoints (affected versions not specified)

Description The issue is related to improper process resource handling in the system scanning component. This could allow a local attacker to disable the scanning functionality, enabling executable files to be launched without being analyzed for threats. An attacker could exploit this by gaining local access to a system running Microsoft Windows and executing a malicious file, preventing the scanning services from functioning properly and leaving the system unprotected from further intrusion.

Recommendations For Cisco Immunet and Cisco Advanced Malware Protection (AMP) for Endpoints, consider restricting local access to systems to minimize the risk of exploitation until a fix is available. As a temporary workaround, consider disabling the scanning component temporarily until a patch is available to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2018-01382

CVE-2018-15437

Affected Products

Cisco Advanced Malware Protection (Amp) For Endpoints

Cisco Immunet

Windows

References · 5

• 🔥 https://exploit-db.com/exploits/45829 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-15437 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-imm-dos · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01382 · Security Note
• http://securityfocus.com/bid/105867 · Note