CVE-2017-12317

The Cisco AMP For Endpoints application allows an authenticated, local attacker to access a static key value stored in the local application software. The vulnerability is due to the use of a static key value stored in the application used to encrypt the connector protection password. An attacker could exploit this vulnerability by gaining local, administrative access to a Windows host and stopping the Cisco AMP for Endpoints service. Cisco Bug IDs: CSCvg42904.

CVSS v3 6.7 MEDIUM
CVSS v2.0 4.6 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/101520	Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171020-ampfe	Vendor Advisory
http://www.securityfocus.com/bid/101520	Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171020-ampfe	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:advanced_malware_protection:3.1\(10\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:3.1\(15\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:4.0\(0\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:4.0\(1\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:4.0\(2\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:4.1\(0\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:4.1\(1\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:4.1\(4\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:4.2\(0\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:4.2\(1\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:4.3\(0\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:4.3\(1\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:4.4\(0\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:4.4\(1\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:4.4\(2\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:4.4\(4\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:5.0\(1\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:5.0\(3\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:5.0\(5\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:5.0\(7\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:5.0\(9\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:5.1\(1\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:5.1\(3\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:5.1\(5\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:5.1\(7\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:5.1\(9\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:5.1\(11\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:5.1\(13\):::::::*
	cpe:2.3:a:cisco:advanced_malware_protection:6.0\(1\):::::::*

History

21 Nov 2024, 03:09

Type	Values Removed	Values Added
References	~~() http://www.securityfocus.com/bid/101520 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/101520 - Third Party Advisory, VDB Entry
References	~~() https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171020-ampfe - Vendor Advisory~~	() https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171020-ampfe - Vendor Advisory

Information

Published : 2017-10-22 18:29

Updated : 2025-04-20 01:37

NVD link : CVE-2017-12317

Mitre link : CVE-2017-12317

CVE.ORG link : CVE-2017-12317

JSON object : View

Products Affected

cisco

advanced_malware_protection

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2017-12317", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}]}, "published": "2017-10-22T18:29:00.277", "references": [{"url": "http://www.securityfocus.com/bid/101520", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171020-ampfe", "tags": ["Vendor Advisory"], "source": "psirt@cisco.com"}, {"url": "http://www.securityfocus.com/bid/101520", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171020-ampfe", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-798"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "The Cisco AMP For Endpoints application allows an authenticated, local attacker to access a static key value stored in the local application software. The vulnerability is due to the use of a static key value stored in the application used to encrypt the connector protection password. An attacker could exploit this vulnerability by gaining local, administrative access to a Windows host and stopping the Cisco AMP for Endpoints service. Cisco Bug IDs: CSCvg42904."}, {"lang": "es", "value": "La aplicaci\u00f3n Cisco AMP For Endpoints permite que un atacante local autenticado acceda a un valor est\u00e1tico de clave almacenado en el software de la aplicaci\u00f3n local. La vulnerabilidad se debe al uso de un valor est\u00e1tico de clave almacenado en la aplicaci\u00f3n que se emplea para codificar la contrase\u00f1a de protecci\u00f3n del conector. Un atacante podr\u00eda explotar esta vulnerabilidad obteniendo acceso local administrativo a un host de Windows y deteniendo el servicio Cisco AMP for Endpoints. Cisco Bug IDs: CSCvg42904."}], "lastModified": "2025-04-20T01:37:25.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:3.1\\(10\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC552AE2-958F-4508-8A18-0F8374208531"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:3.1\\(15\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C534C2C-D0D1-4A86-A9E1-E8327B93DCFD"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:4.0\\(0\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F77CA23-9C21-4149-BF87-F719E3C2FCC2"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:4.0\\(1\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74B43163-EBC4-46DA-9537-2FEFCE8622EA"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:4.0\\(2\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA265977-1948-4FDD-8431-9D2904D8D697"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:4.1\\(0\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7448EF5-8CCE-41D6-B926-780396A30F64"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:4.1\\(1\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4918BE41-30C3-4BDD-BD26-4B1D199BD062"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:4.1\\(4\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F651A64-B2D7-4536-9B8E-539724CA7E4D"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:4.2\\(0\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "72C0356D-5A02-463F-906F-EE591B1B1EB0"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:4.2\\(1\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9CF9771F-2EAB-479D-AA78-C8AFC3AB4DEF"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:4.3\\(0\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9115445E-58A9-4F5D-B246-1E4138CDC0B7"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:4.3\\(1\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F195F11D-A44D-4FDD-BBC6-299DB63EE79F"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:4.4\\(0\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29AB9F91-075A-4541-8BC7-51F5E53FC091"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:4.4\\(1\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B513CB76-597A-432B-9B9D-6E869E772912"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:4.4\\(2\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BFF27510-6D6F-4D67-997E-0A4B75F29F85"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:4.4\\(4\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5AE7785C-8820-4241-84E9-0BCC34AEB246"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:5.0\\(1\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "92A023FE-824C-47E2-8523-FEFB07296B25"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:5.0\\(3\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09D54C61-6E1D-4EB1-B88A-E33FA97FCF31"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:5.0\\(5\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E428D60B-1F49-489C-AE56-9876A8027D77"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:5.0\\(7\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05EE257B-7207-4452-BD40-708FFEC72061"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:5.0\\(9\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D77ECEBF-DC16-4D6B-9AF3-469CEFD583D5"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:5.1\\(1\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09799FA5-06FA-41E2-BB55-79FF544BC11B"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:5.1\\(3\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A83A07CD-D240-4D33-8D0D-1E58217A54AE"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:5.1\\(5\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADBCB13D-8EA3-46F9-A79F-54349331DC27"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:5.1\\(7\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57B610FB-D459-4D66-A730-749CE36CBF5A"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:5.1\\(9\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B87B79C5-A079-4EAE-BD3E-EC4CE9E958FD"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:5.1\\(11\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CDF0AA0-B261-4B76-B95E-FCE413B4CA3E"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:5.1\\(13\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC6B2298-FF45-4AE1-AE50-3339739BDA34"}, {"criteria": "cpe:2.3:a:cisco:advanced_malware_protection:6.0\\(1\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5AC52E2-473E-44BA-B050-A128125A20F4"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}

6.7 /10