PT-2017-1471 · Mcafee · Mcafee Virusscan Enterprise

Published 2017-03-14 · Updated 2017-09-03 · CVE-2016-8021

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions McAfee VirusScan Enterprise versions 2.0.3 and earlier

Description The issue is related to improper verification of cryptographic signatures, which can be exploited by a remote attacker to execute arbitrary code using a specially crafted file. This can allow the attacker to spoof the update server.

Recommendations For versions 2.0.3 and earlier, update to a version that includes the fix for the improper verification of cryptographic signatures to prevent remote attackers from executing arbitrary code.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2017-00611

CVE-2016-8021

Affected Products

Mcafee Virusscan Enterprise

References · 8

• 🔥 https://exploit-db.com/exploits/40911 · Exploit
• https://bdu.fstec.ru/vul/2017-00611 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-8021 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8021 · Vendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10181 · Vendor Advisory
• http://securityfocus.com/bid/94823 · Note
• http://securitytracker.com/id/1037433 · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10181 · Note