Cisco AMP for Endpoints race condition

Summaryinfo

A vulnerability was found in Cisco AMP for Endpoints. It has been declared as critical. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to race condition. The identification of this vulnerability is CVE-2020-3350. The attack can only be executed locally. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco AMP for Endpoints. It has been declared as critical. This vulnerability affects some unknown processing. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect integrity, and availability. CVE summarizes:

A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated, local attacker to cause the running software to delete arbitrary files on the system. The vulnerability is due to a race condition that could occur when scanning malicious files. An attacker with local shell access could exploit this vulnerability by executing a script that could trigger the race condition. A successful exploit could allow the attacker to delete arbitrary files on the system that the attacker would not normally have privileges to delete, producing system instability or causing the endpoint software to stop working.

The weakness was shared 06/18/2020 as cisco-sa-famp-ZEpdXy as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability was named CVE-2020-3350 since 12/12/2019. The attack needs to be approached locally. Required for exploitation is a single authentication. There are neither technical details nor an exploit publicly available.

Upgrading eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Clam AntiVirus
• Cisco AMP for Endpoints

Productinfo

Vendor

• Cisco

Name

• AMP for Endpoints

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion