CVE-2018-0237

A vulnerability in the file type detection mechanism of the Cisco Advanced Malware Protection (AMP) for Endpoints macOS Connector could allow an unauthenticated, remote attacker to bypass malware detection. The vulnerability occurs because the software relies on only the file extension for detecting DMG files. An attacker could exploit this vulnerability by sending a DMG file with a nonstandard extension to a device that is running an affected AMP for Endpoints macOS Connector. An exploit could allow the attacker to bypass configured malware detection. Cisco Bug IDs: CSCve34034.

CVSS v3 5.8 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-amp	Vendor Advisory
https://wwws.nightwatchcybersecurity.com/2018/02/25/research-compressed-files-auto-detection-on-macos/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:advanced_malware_protection_for_endpoints:1.4\(5\):*:*:*:*:mac_os_x:*:*

History

No history.

Information

Published : 2018-04-19 20:29

Updated : 2024-02-04 19:46

NVD link : CVE-2018-0237

Mitre link : CVE-2018-0237

CVE.ORG link : CVE-2018-0237

JSON object : View

Products Affected

cisco

advanced_malware_protection_for_endpoints

CWE

CWE-706

Use of Incorrectly-Resolved Name or Reference

CWE-20

Improper Input Validation

{"id": "CVE-2018-0237", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2018-04-19T20:29:00.643", "references": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-amp", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "https://wwws.nightwatchcybersecurity.com/2018/02/25/research-compressed-files-auto-detection-on-macos/", "tags": ["Third Party Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-706"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the file type detection mechanism of the Cisco Advanced Malware Protection (AMP) for Endpoints macOS Connector could allow an unauthenticated, remote attacker to bypass malware detection. The vulnerability occurs because the software relies on only the file extension for detecting DMG files. An attacker could exploit this vulnerability by sending a DMG file with a nonstandard extension to a device that is running an affected AMP for Endpoints macOS Connector. An exploit could allow the attacker to bypass configured malware detection. Cisco Bug IDs: CSCve34034."}, {"lang": "es", "value": "Una vulnerabilidad en el mecanismo de detecci\u00f3n de tipos de archivo en Cisco Advanced Malware Protection (AMP) para Endpoints macOS Connector podr\u00eda permitir que un atacante remoto no autenticado omita la detecci\u00f3n de malware. La vulnerabilidad ocurre debido a que el software depende solo de la extensi\u00f3n del archivo para detectar archivos DMG. Un atacante podr\u00eda explotar esta vulnerabilidad enviando un archivo DMG con una extensi\u00f3n no est\u00e1ndar a un dispositivo que ejecuta un AMP afectado para Endpoints macOS Connector. Su explotaci\u00f3n podr\u00eda permitir que el atacante omita la detecci\u00f3n de malware configurada. Cisco Bug IDs: CSCve34034."}], "lastModified": "2020-09-04T18:26:53.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:advanced_malware_protection_for_endpoints:1.4\\(5\\):*:*:*:*:mac_os_x:*:*", "vulnerable": true, "matchCriteriaId": "E32A7B4E-FCBA-49FD-AC46-E3F033458D60"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}