CVE-2021-1386: 
Clam AntiVirus vulnerability analysis and mitigation

A vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector, ClamAV for Windows, and Immunet was discovered (CVE-2021-1386). The vulnerability was first published on April 7, 2021, and affects multiple Cisco security products. The issue stems from insufficient validation of directory search paths at runtime, which could allow an authenticated local attacker to perform a DLL hijacking attack (Cisco Security Advisory).

The vulnerability is tracked as CVE-2021-1386 with CWE-427 classification and carries a CVSS base score of 7.0 (High) with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X. The issue specifically affects the DLL loading mechanism in the affected products, where insufficient validation of directory search paths at runtime creates a security weakness (Cisco Security Advisory).

A successful exploitation of this vulnerability could allow an authenticated attacker with valid system credentials to execute arbitrary code with SYSTEM privileges on the affected Windows system. This level of access could potentially give the attacker complete control over the affected system (Cisco Security Advisory).

To exploit this vulnerability, an attacker would need valid credentials on the system and local access. The attack vector involves placing a malicious DLL file on an affected system. The Cisco Product Security Incident Response Team (PSIRT) reported no known malicious use of this vulnerability in the wild (Cisco Security Advisory).

Cisco has released software updates that address this vulnerability. The fixed versions are: Cisco AMP for Endpoints for Windows 7.3.15, ClamAV for Windows 0.103.2, and Immunet 7.4.0. No workarounds are available for this vulnerability, making it critical for affected users to upgrade to the patched versions (Cisco Security Advisory).

The vulnerability was responsibly disclosed by security researchers Kyriakos Economou and Tom Wilson of ZeroPeril Ltd. to Cisco (Cisco Security Advisory).