CVE-2021-1386
published 2021-04-08CVE-2021-1386: A vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector, ClamAV for…
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.28%
20.2th percentile
A vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector, ClamAV for Windows, and Immunet could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected Windows system. To exploit this vulnerability, the attacker would need valid credentials on the system. The vulnerability is due to insufficient validation of directory search paths at run time. An attacker could exploit this vulnerability by placing a malicious DLL file on an affected system. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | advanced_malware_protection_for_endpoints | < 7.3.15 | 7.3.15 |
| cisco | advanced_malware_protection_for_endpoints_windows_connector_clamav_for_windows_a | — | — |
| cisco | cisco_amp_for_endpoints | — | — |
| cisco | clamav | < 0.103.2 | 0.103.2 |
| cisco | immunet | < 7.4.0 | 7.4.0 |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_clamav_0.103.2-1_on_cbl_mariner_1.0 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
cisa7.8HIGH
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
vendor_cisco7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
vendor_redhat·2024-05-22·CVSS 7.8
CVE-2021-47497 [HIGH] CWE-125 kernel: nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
kernel: nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
In the Linux kernel, the following vulnerability has been resolved:
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
If a cell has 'nbits' equal to a multiple of BITS_PER_BYTE the logic
*p &= GENMASK((cell->nbits%BITS_PER_BYTE) - 1, 0);
will become undefined behavior because nbits modulo BITS_PER_BYTE is 0, and we
subtract one from that making a large number that is then shifted more than the
number of bits that fit into an unsigned long.
UBSAN reports this problem:
UBSAN: shift-out-of-bounds in drivers/nvmem/core.c:1386:8
shift exponent 64 is too large for 64-bit type 'unsigned long'
CPU: 6 PID: 7 Comm: kworker/u16:0 Not tainted 5.15.0-rc3+ #9
Hardware name: Google Lazor (rev3+) with KB Backlight (DT)
Workqueue:
CISA
Microsoft Windows Installer Privilege Escalation Vulnerability
cisa·2022-03-03·CVSS 7.8
CVE-2021-41379 [MEDIUM] CWE-1386 Microsoft Windows Installer Privilege Escalation Vulnerability
Vulnerability: Microsoft Windows Installer Privilege Escalation Vulnerability
Affected: Microsoft Windows
Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-41379
Remediation Due Date: 2022-03-17
Microsoft
Cisco Advanced Malware Protection for Endpoints Windows Connector ClamAV for Windows and Immunet DLL Hijacking Vulnerability
vendor_msrc·2021-04-13·CVSS 7.8
CVE-2021-1386 [HIGH] CWE-427 Cisco Advanced Malware Protection for Endpoints Windows Connector ClamAV for Windows and Immunet DLL Hijacking Vulnerability
Cisco Advanced Malware Protection for Endpoints Windows Connector ClamAV for Windows and Immunet DLL Hijacking Vulnerability
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
cisco: cisco
Customer Action Requi
Cisco
Cisco Advanced Malware Protection for Endpoints Windows Connector, ClamAV for Windows, and Immunet DLL Hijacking Vulnerability
vendor_cisco·2021-04-07·CVSS 7.0
CVE-2021-1386 [HIGH] CWE-427 Cisco Advanced Malware Protection for Endpoints Windows Connector, ClamAV for Windows, and Immunet DLL Hijacking Vulnerability
Cisco Advanced Malware Protection for Endpoints Windows Connector, ClamAV for Windows, and Immunet DLL Hijacking Vulnerability
A vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector, ClamAV for Windows, and Immunet could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected Windows system. To exploit this vulnerability, the attacker would need valid credentials on the system.
The vulnerability is due to insufficient validation of directory search paths at run time. An attacker could exploit this vulnerability by placing a malicious DLL file on an affected system. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges.
Cisco has
Cisco
Cisco Advanced Malware Protection for Endpoints Windows Connector, ClamAV for Windows, and Immunet DLL Hijacking Vulnerability
vendor_cisco·CVSS 3.1
CVE-2021-1386 Cisco Advanced Malware Protection for Endpoints Windows Connector, ClamAV for Windows, and Immunet DLL Hijacking Vulnerability
CVE-2021-1386: Cisco Advanced Malware Protection for Endpoints Windows Connector, ClamAV for Windows, and Immunet DLL Hijacking Vulnerability
A vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector, ClamAV for Windows, and Immunet could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected Windows system. To exploit this vulnerability, the attacker would need valid credentials on the system. The vulnerability is due to insufficient validation of directory search paths at run time. An attacker could exploit this vulnerability by placing a malicious DLL file on an affected system. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privilege
GHSA
GHSA-crcr-fw92-82g6: A vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector, ClamAV
ghsa_unreviewed·2022-05-24
CVE-2021-1386 [HIGH] CWE-427 GHSA-crcr-fw92-82g6: A vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector, ClamAV
A vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector, ClamAV for Windows, and Immunet could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected Windows system. To exploit this vulnerability, the attacker would need valid credentials on the system. The vulnerability is due to insufficient validation of directory search paths at run time. An attacker could exploit this vulnerability by placing a malicious DLL file on an affected system. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges.
No detection rules found.
No public exploits indexed.
Talos
Vulnerability Spotlight: Vulnerability in Hancom Office could lead to memory corruption, code execution
blogs_talos·2022-02-16·CVSS 7.8
[HIGH] Vulnerability Spotlight: Vulnerability in Hancom Office could lead to memory corruption, code execution
## Vulnerability Spotlight: Vulnerability in Hancom Office could lead to memory corruption, code execution
Marcin “Icewall” Noga of Cisco Talos discovered these vulnerabilities.
Cisco Talos recently discovered a vulnerability in Hancom Office — a popular software suite in South Korea — that could allow an attacker to corrupt memory on the targeted machine or execute remote code.
Hancom Office offers similar services to that of Microsoft Office, including word processing and spreadsheet creation and management.
TALOS-2021-1386 (CVE-2021-21958) exists in Hancom Office’s HwordApp.dll. An attacker-created malicious document could trigger a heap-based buffer overflow, eventually leading to code execution and/or memory corruption if the attacker follows a specific attack vector.
Cisco Talos
Talos
Vulnerability Spotlight: Vulnerability in Hancom Office could lead to memory corruption, code execution
blogs_talos·2022-02-16·CVSS 7.8
CVE-2021-21958 [HIGH] Vulnerability Spotlight: Vulnerability in Hancom Office could lead to memory corruption, code execution
Marcin “Icewall” Noga of Cisco Talos discovered these vulnerabilities.
Cisco Talos recently discovered a vulnerability in Hancom Office — a popular software suite in South Korea — that could allow an attacker to corrupt memory on the targeted machine or execute remote code.
Hancom Office offers similar services to that of Microsoft Office, including word processing and spreadsheet creation and management.
TALOS-2021-1386 (CVE-2021-21958) exists in Hancom Office’s HwordApp.dll. An attacker-created malicious document could trigger a heap-based buffer overflow, eventually leading to code execution and/or memory corruption if the attacker follows a specific attack vector.
Cisco Talos worked with Hancom to ensure that these issues are resolved and an update is available for affected custome
2021-04-08
Published