False positive Cisco Secure X detected and listed two DLLs as threats

[dmcdonald]

Detected libintl-9.dll, libintl: accessing NLS message catalogs 0.19.8.0

Detected libwinpthread-1.dll, 1.0.0.0 (ffe2d563…92f8fdc9)[PE_Executable] during a flash scan as W32.FFE2D56375-95.SBX.TG.

Secure X was unable to quarantine either file. I suspect this is a false positive but I need to be sure.

Please let me know if i need to post additional details.

Thank you


P.S i made a free account, but my work licenses 3CX through our MSP.

 

[TheodorosG_3CX]

Hello @dmcdonald thank you for the report.
However we will need some more details. Are you scanning on the PBX server or on a machine with the Desktop App?
Also what is the installed version of the PBX?

 

[dmcdonald]

I assume it's the PBX server, I am not sure how to check the version unfortunately. I am pretty new to the company, and everything was deployed by the MSP. there does not seem to be any type of management console on the server itself, just a lot of 3CX services running. Any insight is appreciated.

 

[NikosT_3CX]

Can you please be specific ?
Do you scan the server or your PC ?
Also, do you use a 3cx Web Client, Desktop App or PWA on your PC?

 

[dmcdonald]

Cisco Secure X found them via its automatic scan. I do not use the desktop app on my computer.

I am aware of the security breach from May and i do not believe this is related since the DLLs are different and there are no 3CX apps present on the server.

Attached is a snip of the events in event viewer.

Thank you for bearing with me.

 

[TheodorosG_3CX]

If you access the PBX management console, what is the version of the PBX?

 

[dmcdonald]

I do not know how to access the PBX mgmt console. In program files there is a 3CX management console application, but when i run that CMD pops up for a second then goes away,

 

[NikosT_3CX]

Can you please contact the person who installed it ( MSP ) and then let us know?

 

[dmcdonald]

Sure thing. Thank you

 

[Matt Waechter]

Nikos,
I have a client that just reached out about this issue as well.
3CX is currently at version 18 update 7 (build 312)

 

[dmcdonald]

Just got this response from our MSP

" Any installed Antivirus Software should NOT scan:

C:\Program Files\3CX Phone System\*

C:\ProgramData\3CX\*

3CX is currently at version 18 update 7 (build 312) "

So i guess hes telling me to whitelist those directories?

 

[dmcdonald]

Hey matt. funny running into you here lmao.

 

[TheodorosG_3CX]

@Matt Waechter @dmcdonald Thank you for bringing this to our attention. We have already contacted with Cisco. We will inform you of their response as soon as they get back to us. Our communication will remain transparent throughout this investigation.

Also please report this from your side using the Cisco Support Assistant.

 

[TheodorosG_3CX]

We are marking this alert as False Positive, as we have not received any confirmation from the Vendor. At the moment we have not received any other report from any customer.
Please also ensure that you have also contacted Cisco from your side.