CVE-2020-3350
Description
A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated, local attacker to cause the running software to delete arbitrary files on the system. The vulnerability is due to a race condition that could occur when scanning malicious files. An attacker with local shell access could exploit this vulnerability by executing a script that could trigger the race condition. A successful exploit could allow the attacker to delete arbitrary files on the system that the attacker would not normally have privileges to delete, producing system instability or causing the endpoint software to stop working.
How to fix
- cisco clam_antivirus0.102.4 or later
- cisco advanced_malware_protection_for_endpoints1.12.4 or later
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-famp-ZEpdXy
- security.gentoo.org/glsa/202007-23
- usn.ubuntu.com/4435-1/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QM7EXJHDEZJLWM2NKH6TCDXOBP5NNYIN/
- usn.ubuntu.com/4435-2/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJ67VH37NCG25PICGWFWZHSVG7PBT7MC/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco clam_antivirus | v < 0.102.4 | 0.102.4 |
| cisco advanced_malware_protection_for_endpoints | v < 1.12.4 | 1.12.4 |
| fedoraproject fedora | 31, 32 | — |
| debian debian_linux | 9.0 | — |
| canonical ubuntu_linux | 12.04, 14.04, 16.04, 18.04, 20.04 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.