CVE-2018-15437 Cisco Immunet and Cisco AMP for Endpoints System Scan Denial of Service Vulnerability
A local attacker can disable system scanning in Cisco AMP for Endpoints, allowing malicious executables to run without analysis.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-15437?
CVE-2018-15437 is a medium-severity denial of service vulnerability in Cisco AMP for Endpoints, published on 8 Nov 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability in the system scanning component of Cisco Immunet and Cisco Advanced Malware Protection (AMP) for Endpoints running on Microsoft Windows could allow a local attacker to disable the scanning functionality of the product. This could allow executable files to be launched on the system without being analyzed for threats. The vulnerability is due to improper process resource handling. An attacker could exploit this vulnerability by gaining local access to a system running Microsoft Windows and protected by Cisco Immunet or Cisco AMP for Endpoints and executing a malicious file. A successful exploit could allow the attacker to prevent the scanning services from functioning properly and ultimately prevent the system from being protected from further intrusion.
Weakness: CWE-400
Which versions are affected by CVE-2018-15437?
It affects 2 products.
Products include Cisco Advanced Malware Protection for Endpoints, Cisco Immunet for Endpoints.
How do I fix CVE-2018-15437?
No fix has been published for CVE-2018-15437 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-15437 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-15437 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Cisco AMP for Endpoints
- CVE-2021-1280 Cisco Advanced Malware Protection for Endpoints and Immunet for Windows DLL Hijacking Vulnerability
- CVE-2021-1386 Path traversal in Cisco AMP for Endpoints
- CVE-2019-1932 Cisco Advanced Malware Protection for Endpoints Windows Command Injection Vulnerability
- CVE-2017-12312 Path traversal in Cisco Immunet Antimalware Installer
- CVE-2020-3314 Cisco AMP for Endpoints Mac Connector Software File Scan Denial of Service Vulnerability
Sources
Also known as GHSA-f582-5356-9mc6.