PT-2005-4414 · Mcafee · Mcafee Virusscan Security Center

Peter Vreugdenhil · Published 2005-12-21 · Updated 2011-03-08 · CVE-2005-3657

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions McAfee VirusScan Security Center (affected versions not specified)

Description The issue concerns the ActiveX control in MCINSCTL.DLL, which fails to properly restrict access to required domains using the IObjectSafetySiteLock API. This allows remote attackers to create or append to arbitrary files by exploiting the StartLog and AddLog methods in the MCINSTALL.McLog object.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-3657

Affected Products

Mcafee Virusscan Security Center

References · 7

• http://idefense.com/intelligence/vulnerabilities/display.php?id=358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3657 · Security Note
• http://securitytracker.com/id?1015390 · Note
• http://securityfocus.com/bid/15986 · Note
• http://secunia.com/advisories/18169 · Note
• http://vupen.com/english/advisories/2005/3006 · Note
• http://securityreason.com/securityalert/279 · Note