PT-2016-6008 · Microsoft+1 · Windows+1

Maurizio Agazzini · Published 2016-05-05 · Updated 2016-12-01 · CVE-2016-4534

Positive Technologies (AI Summary)

CVSS v2.0

3.0

Low

Base vector

AV:L/AC:M/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions McAfee VirusScan Enterprise version 8.8.0 before Hotfix 1123565 (8.8.0.1546)

Description The issue allows local administrators to bypass intended self-protection rules and unlock the console window by closing registry handles. This is related to the McAfee VirusScan Console (mcconsol.exe) on Windows.

Recommendations For McAfee VirusScan Enterprise version 8.8.0 before Hotfix 1123565 (8.8.0.1546), apply Hotfix 1123565 (8.8.0.1546) to resolve the issue. As a temporary workaround, consider restricting access to the registry handles related to the McAfee VirusScan Console to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-4534

Affected Products

Mcafee Virusscan Enterprise

Windows

References · 9

• 🔥 https://lab.mediaservice.net/advisory/2016-01-mcafee.txt · Exploit
• 🔥 http://seclists.org/fulldisclosure/2016/Mar/13 · Exploit
• 🔥 https://exploit-db.com/exploits/39531 · Exploit
• 🔥 http://packetstormsecurity.com/files/download/136089/mcafeevses-bypass.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-4534 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4534 · Vendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10158 · Vendor Advisory
• https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/26000/PD26485/en_US/VSE_8_8_HF1123565_release_notes.pdf · Vendor Advisory
• http://securitytracker.com/id/1035754 · Note