CVE-2024-20290: cisco cisco secure endpoint Buffer Over-read

Vulnerability summary

CVE-2024-20290 is a high (CVSS 7.5) Buffer Over-read vulnerability in cisco cisco secure endpoint. EPSS estimates a 33.32% chance of exploitation in the next 30 days, higher than 98.3% of scored vulnerabilities.

Timeline

1. 07-02-2024
   PublishedVulnerability first disclosed.
2. 13-02-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog .

• CWE-126Buffer Over-readThe product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.