PT-2007-2648 · Mcafee · Mcafee Virusscan For Mac

Kevin Finisterre · Published 2007-03-02 · Updated 2018-10-16 · CVE-2007-1227

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions McAfee VirusScan for Mac (Virex) versions prior to 7.7 patch 1

Description The issue allows local users to change permissions of arbitrary files via a symlink attack on /Library/Application Support/Virex/VShieldExclude.txt. This can be exploited to execute arbitrary commands, for example, by symlinking to the root crontab file.

Recommendations For versions prior to 7.7 patch 1, update to version 7.7 patch 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the VShieldExclude.txt file to prevent symlink attacks until a patch is applied.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-1227

Affected Products

Mcafee Virusscan For Mac

References · 11

• 🔥 http://securityfocus.com/bid/22744 · Exploit
• 🔥 https://exploit-db.com/exploits/3386 · Exploit
• 🔥 http://securityreason.com/securityalert/2342 · Exploit
• http://secunia.com/advisories/24337 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1227 · Security Note
• http://osvdb.org/33797 · Note
• http://securitytracker.com/id?1017707 · Note
• http://securityfocus.com/archive/1/461485/100/0/threaded · Note
• https://knowledge.mcafee.com/SupportSite/dynamickc.do?externalId=518722&sliceId=SAL_Public&command=show&forward=nonthreadedKC&kcId=518722 · Note
• http://vupen.com/english/advisories/2007/0777 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32729 · Note