PT-2011-4245 · Mcafee · Mcafee Saas Endpoint Protection

Published 2011-08-10 · Updated 2017-08-29 · CVE-2011-3007

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions McAfee SaaS Endpoint Protection versions 5.2.1 and earlier

Description The issue allows remote attackers to write to arbitrary files by specifying an arbitrary filename in the MyCioScan.Scan.ReportFile parameter. This can be used to inject script into a log file and execute arbitrary code using the MyCioScan.Scan.Start method.

Recommendations For McAfee SaaS Endpoint Protection versions 5.2.1 and earlier, consider restricting access to the MyCioScan.Scan.ReportFile parameter to prevent arbitrary file writing. As a temporary workaround, avoid using the MyCioScan.Scan.Start method until a fix is available.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2011-3007

Affected Products

Mcafee Saas Endpoint Protection

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2011-3007 · Security Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10016 · Vendor Advisory
• http://dvlabs.tippingpoint.com/advisory/TPTI-11-13 · Note
• http://osvdb.org/74513 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/69093 · Note