The Cisco AMP For Endpoints application allows an authenticated, local attacker to access a static key value stored in the local application software. The vulnerability is due to the use of a static key value stored in the application used to encrypt the connector protection password. An attacker could exploit this vulnerability by gaining local, administrative access to a Windows host and stopping the Cisco AMP for Endpoints service. Cisco Bug IDs: CSCvg42904.
The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Advanced_malware_protection | Cisco | 3.1(10) (including) | 3.1(10) (including) |
| Advanced_malware_protection | Cisco | 3.1(15) (including) | 3.1(15) (including) |
| Advanced_malware_protection | Cisco | 4.0(0) (including) | 4.0(0) (including) |
| Advanced_malware_protection | Cisco | 4.0(1) (including) | 4.0(1) (including) |
| Advanced_malware_protection | Cisco | 4.0(2) (including) | 4.0(2) (including) |
| Advanced_malware_protection | Cisco | 4.1(0) (including) | 4.1(0) (including) |
| Advanced_malware_protection | Cisco | 4.1(1) (including) | 4.1(1) (including) |
| Advanced_malware_protection | Cisco | 4.1(4) (including) | 4.1(4) (including) |
| Advanced_malware_protection | Cisco | 4.2(0) (including) | 4.2(0) (including) |
| Advanced_malware_protection | Cisco | 4.2(1) (including) | 4.2(1) (including) |
| Advanced_malware_protection | Cisco | 4.3(0) (including) | 4.3(0) (including) |
| Advanced_malware_protection | Cisco | 4.3(1) (including) | 4.3(1) (including) |
| Advanced_malware_protection | Cisco | 4.4(0) (including) | 4.4(0) (including) |
| Advanced_malware_protection | Cisco | 4.4(1) (including) | 4.4(1) (including) |
| Advanced_malware_protection | Cisco | 4.4(2) (including) | 4.4(2) (including) |
| Advanced_malware_protection | Cisco | 4.4(4) (including) | 4.4(4) (including) |
| Advanced_malware_protection | Cisco | 5.0(1) (including) | 5.0(1) (including) |
| Advanced_malware_protection | Cisco | 5.0(3) (including) | 5.0(3) (including) |
| Advanced_malware_protection | Cisco | 5.0(5) (including) | 5.0(5) (including) |
| Advanced_malware_protection | Cisco | 5.0(7) (including) | 5.0(7) (including) |
| Advanced_malware_protection | Cisco | 5.0(9) (including) | 5.0(9) (including) |
| Advanced_malware_protection | Cisco | 5.1(1) (including) | 5.1(1) (including) |
| Advanced_malware_protection | Cisco | 5.1(3) (including) | 5.1(3) (including) |
| Advanced_malware_protection | Cisco | 5.1(5) (including) | 5.1(5) (including) |
| Advanced_malware_protection | Cisco | 5.1(7) (including) | 5.1(7) (including) |
| Advanced_malware_protection | Cisco | 5.1(9) (including) | 5.1(9) (including) |
| Advanced_malware_protection | Cisco | 5.1(11) (including) | 5.1(11) (including) |
| Advanced_malware_protection | Cisco | 5.1(13) (including) | 5.1(13) (including) |
| Advanced_malware_protection | Cisco | 6.0(1) (including) | 6.0(1) (including) |
Hard-coded credentials typically create a significant hole that allows an attacker to bypass the authentication that has been configured by the product administrator. This hole might be difficult for the system administrator to detect. Even if detected, it can be difficult to fix, so the administrator may be forced into disabling the product entirely. There are two main variations:
In the Inbound variant, a default administration account is created, and a simple password is hard-coded into the product and associated with that account. This hard-coded password is the same for each installation of the product, and it usually cannot be changed or disabled by system administrators without manually modifying the program, or otherwise patching the product. If the password is ever discovered or published (a common occurrence on the Internet), then anybody with knowledge of this password can access the product. Finally, since all installations of the product will have the same password, even across different organizations, this enables massive attacks such as worms to take place. The Outbound variant applies to front-end systems that authenticate with a back-end service. The back-end service may require a fixed password which can be easily discovered. The programmer may simply hard-code those back-end credentials into the front-end product. Any user of that program may be able to extract the password. Client-side systems with hard-coded passwords pose even more of a threat, since the extraction of a password from a binary is usually very simple.