CVE-2018-15452— Cisco Advanced Malware Protection for Endpoints for Windows DLL加载组件安全漏洞

Cisco Advanced Malware Protection for Endpoints on Windows DLL Preloading Vulnerability

A vulnerability in the DLL loading component of Cisco Advanced Malware Protection (AMP) for Endpoints on Windows could allow an authenticated, local attacker to disable system scanning services or take other actions to prevent detection of unauthorized intrusions. To exploit this vulnerability, the attacker would need to have administrative credentials on the Windows system. The vulnerability is due to the improper validation of resources loaded by a system process at run time. An attacker could exploit this vulnerability by crafting a malicious DLL file and placing it in a specific location on the targeted system. A successful exploit could allow the attacker to disable the targeted system's scanning services and ultimately prevent the system from being protected from further intrusion. There are no workarounds that address this vulnerability.

N/A

对搜索路径元素未加控制

Cisco Advanced Malware Protection for Endpoints for Windows DLL加载组件安全漏洞

Cisco Advanced Malware Protection（AMP）for Endpoints for Windows是美国思科（Cisco）公司的一款基于Windows平台的端点安全解决方案。该产品主要具有高级威胁预防、监测和响应等功能。 基于Windows平台的Cisco AMP for Endpoints中的DLL加载组件存在安全漏洞，该漏洞源于在运行时，程序对系统进程加载的资源验证不当。本地攻击者可通过创建恶意的DLL文件并将其放置在目标系统上利用该漏洞禁用目标系统的扫描服务，进而无法进行

N/A

N/A