CVE-2018-0237 Security feature bypass in Cisco AMP for Endpoints

What is CVE-2018-0237?

CVE-2018-0237 is a medium-severity vulnerability in Cisco AMP for Endpoints, published on 19 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the file type detection mechanism of the Cisco Advanced Malware Protection (AMP) for Endpoints macOS Connector could allow an unauthenticated, remote attacker to bypass malware detection. The vulnerability occurs because the software relies on only the file extension for detecting DMG files. An attacker could exploit this vulnerability by sending a DMG file with a nonstandard extension to a device that is running an affected AMP for Endpoints macOS Connector. An exploit could allow the attacker to bypass configured malware detection. Cisco Bug IDs: CSCve34034.

Weakness: CWE-706, CWE-20

Which versions are affected by CVE-2018-0237?

It affects 1 product.

Products include Cisco Advanced Malware Protection for Endpoints.

How do I fix CVE-2018-0237?

No fix has been published for CVE-2018-0237 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-0237 being exploited?

There is no known exploitation of CVE-2018-0237 in the wild and no public exploit code.

Other vulnerabilities in Cisco AMP for Endpoints

• CVE-2021-1280 Cisco Advanced Malware Protection for Endpoints and Immunet for Windows DLL Hijacking Vulnerability High 7.8
• CVE-2021-1386 Path traversal in Cisco AMP for Endpoints High 7.0
• CVE-2019-1932 Cisco Advanced Malware Protection for Endpoints Windows Command Injection Vulnerability Medium 6.7
• CVE-2017-12312 Path traversal in Cisco Immunet Antimalware Installer Medium 6.7
• CVE-2020-3314 Cisco AMP for Endpoints Mac Connector Software File Scan Denial of Service Vulnerability Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c2m9-xh9p-789c.