PT-2023-2001 · Mcafee · Mcafee Total Protection

CVE-2023-25134 · Publicado 2023-03-21 · Atualizado 2025-02-28

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Média

Vetor base

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions McAfee Total Protection versions prior to 16.0.50

Description The issue is related to insufficient access control to the registry, allowing an adversary with full administrative access to modify a McAfee specific Component Object Model (COM) in the Windows Registry. This modification can result in the loading of a malicious payload.

Recommendations For versions prior to 16.0.50, update to version 16.0.50 or later to resolve the issue. As a temporary workaround, consider restricting access to the Windows Registry to minimize the risk of exploitation.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2023-01624

CVE-2023-25134

Produtos afetados

Mcafee Total Protection

Referências · 10

• https://mcafee.com/support/?articleId=TS103398&page=shell&shell=article-view · Aviso do Fabricante
• https://mcafee.com/support/?articleId=TS103398&page=shell&shell=article-view · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25134 · Nota de Segurança
• https://mcafee.com/en-us/consumer-corporate/mcafee-labs/product-security-bulletins.html · Aviso do Fabricante
• https://t.me/cibsecurity/60399 · Publicação no Telegram
• https://mcafee.com/blogs/other-blogs/mcafee-labs/threat-actors-employ-com-technology-shellcode-evade-detection · Nota
• https://t.me/cvenotify/112915 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-01624 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-25134 · Aviso do Fabricante
• https://t.me/cvenotify/46554 · Publicação no Telegram