14 DAY TRIAL // Cisco announced in a security advisory that a DLL preloading vulnerability in the DLL loading component of the Advanced Malware Protection (AMP) for Endpoints allows authenticated local attackers to block Windows from detecting future intrusions on the system.
"The vulnerability is due to the improper validation of resources loaded by a system process at run time. An attacker could exploit this vulnerability by crafting a malicious DLL file and placing it in a specific location on the targeted system," as described in Cisco's advisory.
"A successful exploit could allow the attacker to disable the targeted system's scanning services and ultimately prevent the system from being protected from further intrusion."
The medium risk CVE-2018-15452 security issue allows potential local attackers with administrative privileges to block the Windows built-in intrusion detection mechanisms from detecting and reporting future infiltration attempts.
The CVE-2018-15452 issue allows local attackers with elevated privileges to block Windows from detecting intrusion attempts
As Cisco also points out, "To exploit this vulnerability, the attacker would need to have administrative credentials on the Windows system."
There are no workarounds available at the moment for this DLL preloading security bug and users can find further information on the Cisco Advanced Malware Protection (AMP) for Endpoint versions affected by this vulnerability by taking a closer look at the Cisco bug ID at the top of the advisory.
Furthermore, the bug was detected during a Cisco Technical Assistance Center support case's resolution and the Cisco Product Security Incident Response Team (PSIRT) has not observed any instances of this security issue being exploited in the wild.
Customers who want to make sure that they patch their systems as soon as a software update is available should monitor the "Cisco Advanced Malware Protection for Endpoints on Windows DLL Preloading Vulnerability" security advisory page.