cnvd - cnvd-2019-00341

cnvd-2019-00341

Vulnerability from cnvd

Title: Cisco Immunet和Cisco AMP for Endpoints本地拒绝服务漏洞

Description:

Cisco Immunet和AMP for Endpoints都是美国思科（Cisco）公司的产品。Cisco Immunet是一套恶意软件防护程序。AMP for Endpoints是一套集成了静态和动态恶意软件分析以及威胁情报于一体的终端应用程序。

基于Microsoft Windows平台的Cisco Immunet和AMP for Endpoints中的系统扫描组件存在拒绝服务漏洞。本地攻击者可利用该漏洞禁用产品的扫描功能。

Severity: 中

Patch Name: Cisco Immunet和Cisco AMP for Endpoints本地拒绝服务漏洞的补丁

Patch Description:

基于Microsoft Windows平台的Cisco Immunet和AMP for Endpoints中的系统扫描组件存在拒绝服务漏洞。本地攻击者可利用该漏洞禁用产品的扫描功能。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-imm-dos

Reference: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-imm-dos

Impacted products

Name
['Cisco mmunet 无', 'Cisco AMP for Endpoints 0']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "105867"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-15437",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15437"
    }
  },
  "description": "Cisco Immunet\u548cAMP for Endpoints\u90fd\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Cisco Immunet\u662f\u4e00\u5957\u6076\u610f\u8f6f\u4ef6\u9632\u62a4\u7a0b\u5e8f\u3002AMP for Endpoints\u662f\u4e00\u5957\u96c6\u6210\u4e86\u9759\u6001\u548c\u52a8\u6001\u6076\u610f\u8f6f\u4ef6\u5206\u6790\u4ee5\u53ca\u5a01\u80c1\u60c5\u62a5\u4e8e\u4e00\u4f53\u7684\u7ec8\u7aef\u5e94\u7528\u7a0b\u5e8f\u3002\n\n\u57fa\u4e8eMicrosoft Windows\u5e73\u53f0\u7684Cisco Immunet\u548cAMP for Endpoints\u4e2d\u7684\u7cfb\u7edf\u626b\u63cf\u7ec4\u4ef6\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7981\u7528\u4ea7\u54c1\u7684\u626b\u63cf\u529f\u80fd\u3002",
  "discovererName": "John Page (hyp3rlinx) of ApparitionSe",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-imm-dos",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-00341",
  "openTime": "2019-01-04",
  "patchDescription": "Cisco Immunet\u548cAMP for Endpoints\u90fd\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Cisco Immunet\u662f\u4e00\u5957\u6076\u610f\u8f6f\u4ef6\u9632\u62a4\u7a0b\u5e8f\u3002AMP for Endpoints\u662f\u4e00\u5957\u96c6\u6210\u4e86\u9759\u6001\u548c\u52a8\u6001\u6076\u610f\u8f6f\u4ef6\u5206\u6790\u4ee5\u53ca\u5a01\u80c1\u60c5\u62a5\u4e8e\u4e00\u4f53\u7684\u7ec8\u7aef\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\n\u57fa\u4e8eMicrosoft Windows\u5e73\u53f0\u7684Cisco Immunet\u548cAMP for Endpoints\u4e2d\u7684\u7cfb\u7edf\u626b\u63cf\u7ec4\u4ef6\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7981\u7528\u4ea7\u54c1\u7684\u626b\u63cf\u529f\u80fd\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco Immunet\u548cCisco AMP for Endpoints\u672c\u5730\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Cisco mmunet \u65e0",
      "Cisco AMP for Endpoints 0"
    ]
  },
  "referenceLink": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-imm-dos",
  "serverity": "\u4e2d",
  "submitTime": "2018-11-09",
  "title": "Cisco Immunet\u548cCisco AMP for Endpoints\u672c\u5730\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2018-15437 (GCVE-0-2018-15437)

Vulnerability from cvelistv5

Published

2018-11-08 17:00

Modified

2024-11-26 14:22

Severity ?

5.5 (Medium) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-400

Summary

A vulnerability in the system scanning component of Cisco Immunet and Cisco Advanced Malware Protection (AMP) for Endpoints running on Microsoft Windows could allow a local attacker to disable the scanning functionality of the product. This could allow executable files to be launched on the system without being analyzed for threats. The vulnerability is due to improper process resource handling. An attacker could exploit this vulnerability by gaining local access to a system running Microsoft Windows and protected by Cisco Immunet or Cisco AMP for Endpoints and executing a malicious file. A successful exploit could allow the attacker to prevent the scanning services from functioning properly and ultimately prevent the system from being protected from further intrusion.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/105867	vdb-entry, x_refsource_BID
	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-imm-dos	vendor-advisory, x_refsource_CISCO
	https://www.exploit-db.com/exploits/45829/	exploit, x_refsource_EXPLOIT-DB

Impacted products

	Vendor	Product	Version
	Cisco	Cisco AMP for Endpoints	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T09:54:03.458Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "105867",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105867"
          },
          {
            "name": "20181107 Cisco Immunet and Cisco AMP for Endpoints System Scan Denial of Service Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-imm-dos"
          },
          {
            "name": "45829",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/45829/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2018-15437",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-25T18:47:23.336361Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-26T14:22:28.241Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco AMP for Endpoints",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-11-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the system scanning component of Cisco Immunet and Cisco Advanced Malware Protection (AMP) for Endpoints running on Microsoft Windows could allow a local attacker to disable the scanning functionality of the product. This could allow executable files to be launched on the system without being analyzed for threats. The vulnerability is due to improper process resource handling. An attacker could exploit this vulnerability by gaining local access to a system running Microsoft Windows and protected by Cisco Immunet or Cisco AMP for Endpoints and executing a malicious file. A successful exploit could allow the attacker to prevent the scanning services from functioning properly and ultimately prevent the system from being protected from further intrusion."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-11-15T10:57:01",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "105867",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105867"
        },
        {
          "name": "20181107 Cisco Immunet and Cisco AMP for Endpoints System Scan Denial of Service Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-imm-dos"
        },
        {
          "name": "45829",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/45829/"
        }
      ],
      "source": {
        "advisory": "cisco-sa-20181107-imm-dos",
        "defect": [
          [
            "CSCvk70945",
            "CSCvn05551"
          ]
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Immunet and Cisco AMP for Endpoints System Scan Denial of Service Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2018-11-07T16:00:00-0600",
          "ID": "CVE-2018-15437",
          "STATE": "PUBLIC",
          "TITLE": "Cisco Immunet and Cisco AMP for Endpoints System Scan Denial of Service Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco AMP for Endpoints",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the system scanning component of Cisco Immunet and Cisco Advanced Malware Protection (AMP) for Endpoints running on Microsoft Windows could allow a local attacker to disable the scanning functionality of the product. This could allow executable files to be launched on the system without being analyzed for threats. The vulnerability is due to improper process resource handling. An attacker could exploit this vulnerability by gaining local access to a system running Microsoft Windows and protected by Cisco Immunet or Cisco AMP for Endpoints and executing a malicious file. A successful exploit could allow the attacker to prevent the scanning services from functioning properly and ultimately prevent the system from being protected from further intrusion."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
          }
        ],
        "impact": {
          "cvss": {
            "baseScore": "5.5",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-400"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "105867",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105867"
            },
            {
              "name": "20181107 Cisco Immunet and Cisco AMP for Endpoints System Scan Denial of Service Vulnerability",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-imm-dos"
            },
            {
              "name": "45829",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/45829/"
            }
          ]
        },
        "source": {
          "advisory": "cisco-sa-20181107-imm-dos",
          "defect": [
            [
              "CSCvk70945",
              "CSCvn05551"
            ]
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2018-15437",
    "datePublished": "2018-11-08T17:00:00Z",
    "dateReserved": "2018-08-17T00:00:00",
    "dateUpdated": "2024-11-26T14:22:28.241Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted