Advanced Malware Protection Affected by Bug That Can Inhibit Intrusion Detection

[silversurfer]

Cisco announced in a security advisory that a DLL preloading vulnerability in the DLL loading component of the Advanced Malware Protection (AMP) for Endpoints allows authenticated local attackers to block Windows from detecting future intrusions on the system.

"The vulnerability is due to the improper validation of resources loaded by a system process at run time. An attacker could exploit this vulnerability by crafting a malicious DLL file and placing it in a specific location on the targeted system," as described in Cisco's advisory.
"A successful exploit could allow the attacker to disable the targeted system's scanning services and ultimately prevent the system from being protected from further intrusion."

The medium risk CVE-2018-15452 security issue allows potential local attackers with administrative privileges to block the Windows built-in intrusion detection mechanisms from detecting and reporting future infiltration attempts.

Source: https://news.softpedia.com/news/advanced...3490.shtml