Advanced Malware Protection Affected by Bug That Can Inhibit Intrusion Detection

Cisco announced in a security advisory that a DLL preloading vulnerability in the DLL loading component of the Advanced Malware Protection (AMP) for Endpoints allows authenticated local attackers to block Windows from detecting future intrusions on the system.

"The vulnerability is due to the improper validation of resources loaded by a system process at run time. An attacker could exploit this vulnerability by crafting a malicious DLL file and placing it in a specific location on the targeted system," as described in Cisco's advisory.

"A successful exploit could allow the attacker to disable the targeted system's scanning services and ultimately prevent the system from being protected from further intrusion."

The medium risk CVE-2018-15452 security issue allows potential local attackers with administrative privileges to block the Windows built-in intrusion detection mechanisms from detecting and reporting future infiltration attempts.

The CVE-2018-15452 ... (read more)

1 comment:

  1. That’s a great article. Happy to see a torch bearer against malware. Welcome to the group! You can get further information on all such topics on our page Virus Removal Guidelines News Update. Please go through the articles and help us spread the message to the world!

    ReplyDelete