McAfee Patches Privilege Escalation Flaw in Antivirus Software

guest · Nov 12, 2019

McAfee Patches Privilege Escalation Flaw in Antivirus Software
November 12, 2019
https://www.bleepingcomputer.com/ne...vilege-escalation-flaw-in-antivirus-software/

McAfee patched a security vulnerability discovered in all editions of its Antivirus software for Windows and enabling potential attackers to escalate privileges and execute code using SYSTEM privileges.
McAfee Total Protection (MTP), McAfee Anti-Virus Plus (AVP), and McAfee Internet Security (MIS) up to and including 16.0.R22 are all impacted by this local privilege escalation (LPE) bug.

The company is rolling out the 16.0.R22 Refresh 1 version which addresses the issue says the SafeBreach Labs security researcher in his report.
Arbitrary unsigned DLL loading from CWD
The SafeBreach Labs researcher says that CVE-2019-3648 is caused because the antivirus solution is attempting to load a DLL from its current working directory (CWD) instead of its actual location and by not validating if the DLLs it's trying to load is signed with a digital certificate.

"The vulnerability gives attackers the ability to load and execute malicious payloads using multiple signed services, within the context of McAfee’s signed processes," Hadar says.
Click to expand...

SafeBreach Labs: McAfee - All Editions (MTP, AVP, MIS) - Self-Defense Bypass and Potential Usages (CVE-2019-3648)

Log in or Sign up

McAfee Patches Privilege Escalation Flaw in Antivirus Software

guest Guest

Log in or Sign up

McAfee Patches Privilege Escalation Flaw in Antivirus Software

guest Guest

Useful Searches