PT-2006-7083 · Mcafee · Mcafee Virusscan For Linux

Jakub Moc · Published 2006-12-14 · Updated 2017-07-29 · CVE-2006-6474

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions McAfee VirusScan for Linux versions 4510e and earlier

Description The issue concerns an untrusted search path vulnerability. It includes the current working directory in the DT RPATH environment variable, allowing local users to load arbitrary ELF DSO libraries and execute arbitrary code by installing malicious libraries in that directory.

Recommendations For McAfee VirusScan for Linux versions 4510e and earlier, consider restricting access to the DT RPATH environment variable to prevent local users from loading arbitrary ELF DSO libraries until a patch is available.

Fix

Related Identifiers

CVE-2006-6474

Affected Products

Mcafee Virusscan For Linux

References · 8

• http://security.gentoo.org/glsa/glsa-200612-15.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6474 · Security Note
• http://secunia.com/advisories/23429 · Note
• http://securitytracker.com/id?1017385 · Note
• http://securityfocus.com/bid/21592 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30898 · Note
• http://vupen.com/english/advisories/2006/5023 · Note
• http://secunia.com/advisories/23278 · Note