Detections
Analytics
Cisco Secure Endpoint DoS (cisco-sa-clamav-dos-FTkhqMWZ)
high Nessus Plugin ID 190509
Language:
Synopsis
The remote device is missing a vendor-supplied security patch.Description
A vulnerability in the Cisco Secure Endpoint AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.Please see the included Cisco BIDs and Cisco Security Advisory for more information.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwf30972, CSCwf30973See Also
http://www.nessus.org/u?318a8832
Plugin Details
Severity: High
ID: 190509
File Name: cisco-sa-clamav-dos-FTkhqMWZ.nasl
Version: 1.1
Type: local
Family: CISCO
Published: 2/14/2024
Updated: 2/20/2024
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2023-20212
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:cisco:secure_endpoint
Required KB Items: SMB/Registry/Enumerated, installed_sw/Cisco Secure Endpoint
Exploit Ease: No known exploits are available
Patch Publication Date: 8/16/2023
Vulnerability Publication Date: 8/16/2023
Reference Information
CVE: CVE-2023-20212