PT-2011-4244 · Mcafee · Mcafee Saas Endpoint Protection

Publicado 2011-08-10 · Atualizado 2017-08-29 · CVE-2011-3006

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions McAfee SaaS Endpoint Protection versions 5.2.1 and earlier

Description The issue allows remote attackers to bypass the MyASUtil.SecureObjectFactory.CreateSecureObject domain execution policy using a cross-site scripting (XSS) attack, execute arbitrary code using the MyASUtil.InstallInfo.RunUserProgram function, and possibly conduct other unspecified attacks.

Recommendations For McAfee SaaS Endpoint Protection versions 5.2.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-3006

Produtos afetados

Mcafee Saas Endpoint Protection

Referências · 5

• http://dvlabs.tippingpoint.com/advisory/TPTI-11-12 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-3006 · Nota de Segurança
• http://osvdb.org/74512 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/69094 · Nota
• https://kc.mcafee.com/corporate/index?page=content&id=SB10016 · Aviso do Fabricante