PT-2006-4807 · Mcafee · Mcafee Securitycenter

Karl Lynn · Published 2006-08-01 · Updated 2018-10-17 · CVE-2006-3961

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions McAfee Security Center version 6.0.23

Description The issue is related to a buffer overflow in the McSubMgr ActiveX control, which allows remote attackers to execute arbitrary commands. This is achieved by providing long string parameters that are later used in vsprintf, leading to the potential execution of malicious code.

Recommendations For McAfee Security Center version 6.0.23, update to a newer version that contains a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting the use of the McSubMgr ActiveX control until a patch is available. Avoid using long string parameters in the affected control to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2006-3961

Affected Products

Mcafee Securitycenter

References · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mcafee_mcsubmgr_vsprintf.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16510 · Exploit
• http://vupen.com/english/advisories/2006/3096 · Vendor Advisory
• http://securityfocus.com/bid/19265 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-3961 · Security Note
• http://secunia.com/advisories/21264 · Vendor Advisory
• http://securitytracker.com/id?1016614 · Note
• http://kb.cert.org/vuls/id/481212 · Note
• http://eeye.com/html/research/upcoming/20060719.html · Note
• http://osvdb.org/27698 · Note
• http://ts.mcafeehelp.com/faq3.asp?docid=407052 · Note
• http://eeye.com/html/research/advisories/AD2006807.html · Note
• http://securityfocus.com/archive/1/442495/100/100/threaded · Note