PT-2006-4807 · Mcafee · Mcafee Securitycenter

Karl Lynn · Publicado 2006-08-01 · Atualizado 2018-10-17 · CVE-2006-3961

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions McAfee Security Center version 6.0.23

Description The issue is related to a buffer overflow in the McSubMgr ActiveX control, which allows remote attackers to execute arbitrary commands. This is achieved by providing long string parameters that are later used in vsprintf, leading to the potential execution of malicious code.

Recommendations For McAfee Security Center version 6.0.23, update to a newer version that contains a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting the use of the McSubMgr ActiveX control until a patch is available. Avoid using long string parameters in the affected control to minimize the risk of exploitation.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2006-3961

Produtos afetados

Mcafee Securitycenter

Referências · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mcafee_mcsubmgr_vsprintf.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16510 · Exploit
• http://vupen.com/english/advisories/2006/3096 · Aviso do Fabricante
• http://securitytracker.com/id?1016614 · Nota
• http://securityfocus.com/bid/19265 · Correção
• http://kb.cert.org/vuls/id/481212 · Nota
• http://eeye.com/html/research/upcoming/20060719.html · Nota
• http://osvdb.org/27698 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3961 · Nota de Segurança
• http://ts.mcafeehelp.com/faq3.asp?docid=407052 · Nota
• http://eeye.com/html/research/advisories/AD2006807.html · Nota
• http://secunia.com/advisories/21264 · Aviso do Fabricante
• http://securityfocus.com/archive/1/442495/100/100/threaded · Nota