PT-2018-2780 · Mcafee · Mcafee Agent

Published 2018-12-11 · Updated 2023-01-27 · CVE-2018-6703

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions McAfee Agent versions prior to 5.6.0

Description The issue is related to a use after free vulnerability in the client component of McAfee Agent. This can be exploited by sending specially crafted HTTP requests, potentially allowing a remote attacker to execute arbitrary code or cause a denial of service. The vulnerability is associated with the remote logging feature, which is disabled by default.

Recommendations For McAfee Agent versions prior to 5.6.0, update to version 5.6.0 or later to resolve the issue. As a temporary workaround, consider disabling the remote logging feature to minimize the risk of exploitation.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2019-01816

CVE-2018-6703

Affected Products

Mcafee Agent

References · 6

• https://bdu.fstec.ru/vul/2019-01816 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-6703 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6703 · Vendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10258 · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10258&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_GB · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10258&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_GB · Note