Cisco AMP for Endpoints Static Key Vulnerability

by CIRT Team

22 Oct 2017

in Security Advisories & Alerts

No Comments

1546

Description: On October 20th, 2017, Cisco PSIRT was notified by the internal product team of a security vulnerability in the Cisco AMP for Endpoints application that would allow an authenticated, local attacker to access a static key value stored in the local application software.

Impact: The vulnerability is due to the use of a static key value stored in the application used to encrypt the connector protection password. An attacker could exploit this vulnerability by gaining local, administrative access to a Windows host and stopping the Cisco AMP for Endpoints service. This vulnerability affects Cisco AMP for Endpoints for Windows Operating Systems.

Mitigation: Administrators may disable administrative privileges on the Windows machines that have Cisco AMP for Endpoints installed. For information about fixed software releases, consult with vendor.

Reference URL’s: