CVE-2023-20212

A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-dos-FTkhqMWZ	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:secure_endpoint::::::linux::*
	cpe:2.3:a:cisco:secure_endpoint_private_cloud::::::::

History

25 Jan 2024, 17:15

Type	Values Removed	Values Added
CWE		CWE-825

24 Aug 2023, 14:18

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo
First Time		Cisco secure Endpoint Cisco Cisco secure Endpoint Private Cloud
CPE		cpe:2.3:a:cisco:secure_endpoint_private_cloud:::::::: cpe:2.3:a:cisco:secure_endpoint::::::linux::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
References	~~(MISC) https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-dos-FTkhqMWZ -~~	(MISC) https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-dos-FTkhqMWZ - Vendor Advisory

18 Aug 2023, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-08-18 20:15

Updated : 2024-01-25 17:15

NVD link : CVE-2023-20212

Mitre link : CVE-2023-20212

CVE.ORG link : CVE-2023-20212

JSON object : View

Products Affected

cisco

secure_endpoint_private_cloud
secure_endpoint

CWE

NVD-CWE-noinfo CWE-825

Expired Pointer Dereference

{"id": "CVE-2023-20212", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-08-18T20:15:09.773", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-dos-FTkhqMWZ", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-825"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. \r\n\r This vulnerability is due to a logic error in the memory management of an affected device. An attacker could exploit this vulnerability by submitting a crafted AutoIt file to be scanned by ClamAV on the affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to restart unexpectedly, resulting in a DoS condition."}, {"lang": "es", "value": "Una vulnerabilidad en el m\u00f3dulo AutoIt de ClamAV podr\u00eda permitir a un atacante remoto no autenticado causar una condici\u00f3n de denegaci\u00f3n de servicio (DoS) en un dispositivo afectado. Esta vulnerabilidad se debe a un error l\u00f3gico en la gesti\u00f3n de memoria de un dispositivo afectado. Un atacante podr\u00eda explotar esta vulnerabilidad enviando un archivo AutoIt manipulado para ser escaneado por ClamAV en el dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante causar que el proceso de escaneo de ClamAV se reinicie inesperadamente, resultando en una condici\u00f3n de DoS. "}], "lastModified": "2024-01-25T17:15:37.033", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:secure_endpoint:*:*:*:*:*:linux:*:*", "vulnerable": true, "matchCriteriaId": "57FA75E8-D452-4A42-A7D8-064C3932888A", "versionEndExcluding": "8.1.7.21585"}, {"criteria": "cpe:2.3:a:cisco:secure_endpoint_private_cloud:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D10B7EE9-96DE-4761-834A-FA5C31326A23", "versionEndExcluding": "3.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}