CVE-2016-3984 The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL) before 2.0.1.140.1,....
MediumCVSS 5.1
EPSS 1.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL) before 2.0.1.140.1, Data Loss Prevention Endpoint (DLPe) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Device Control (MDC) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Endpoint Security (ENS) 10.x before 10.1, Host Intrusion Prevention Service (IPS) 8.0 before 8.0.0.3624, and VirusScan Enterprise (VSE) 8.8 before P7 (8.8.0.1528) on Windows allows local administrators to bypass intended self-protection rules and disable the antivirus engine by modifying registry keys.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mcafee active response | <= 1.1.0.158 | No fix listed |
| mcafee agent | <= 5.0.2.285 | No fix listed |
| mcafee data exchange layer | <= 2.0.0.430.1 | No fix listed |
| mcafee data loss prevention endpoint | <= 9.3.0 | No fix listed |
| mcafee data loss prevention endpoint | <= 9.4.0 | No fix listed |
| mcafee endpoint security | <= 10.0.1 | No fix listed |
| mcafee host intrusion prevention | <= 8.0.0 | No fix listed |
| mcafee virusscan enterprise | <= 8.8.0 | No fix listed |
References
- lab.mediaservice.net exploit
- 20160304 McAfee VirusScan Enterprise security restrictions bypass mailing-list
- 1035130 vdb-entry
- kc.mcafee.com vendor-advisory
- 39531 exploit