PT-2021-2566 · Cisco · Cisco Advanced Malware Protection For Endpoints Windows Connector
Kyriakos Economou
+1
·
Published
2021-04-07
·
Updated
2021-04-19
·
CVE-2021-1386
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Cisco Advanced Malware Protection for Endpoints Windows Connector versions (affected versions not specified)
ClamAV for Windows versions (affected versions not specified)
Immunet versions (affected versions not specified)
Description:
The issue is related to errors in the dynamic link library (DLL) loading mechanism, specifically due to insufficient validation of directory search paths at run time. This could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected Windows system. The attacker would need valid credentials on the system to exploit this issue. By placing a malicious DLL file on an affected system, an attacker could execute arbitrary code with SYSTEM privileges.
Recommendations:
For Cisco Advanced Malware Protection for Endpoints Windows Connector, restrict access to the DLL loading mechanism until a patch is available.
For ClamAV for Windows, consider disabling the dynamic link library loading feature as a temporary workaround until a fix is provided.
For Immunet, avoid using the vulnerable DLL loading mechanism in the affected Windows system until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Uncontrolled Search Path Element
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Advanced Malware Protection For Endpoints Windows Connector