PT-2020-3054 · Cisco · Cisco Amp For Endpoints

Published 2020-05-22 · Updated 2021-10-19 · CVE-2020-3314

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Cisco AMP for Endpoints (affected versions not specified)

Description The issue is related to insufficient input validation of specific file attributes in the file scan process of Cisco AMP for Endpoints Mac Connector Software. This could cause the scan engine to crash during the scan of local files, resulting in a restart of the AMP Connector and a denial of service (DoS) condition of the Cisco AMP for Endpoints service. An attacker could exploit this by providing a crafted file to a user of an affected system, potentially causing the service to crash and resulting in missed detection and logging of potentially malicious files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-03344

CVE-2020-3314

Affected Products

Cisco Amp For Endpoints

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-amp4emac-dos-kfKjUGtM · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3314 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3314 · Security Note
• https://bdu.fstec.ru/vul/2020-03344 · Security Note
• https://t.me/cvenotify/4012 · Telegram Post