PT-2018-2861 · Mcafee · Mcafee Agent For Linux

CVE-2018-6704 · Published 2018-12-12 · Updated 2023-01-27

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions McAfee Agent for Linux versions 5.0.0 through 5.0.6 McAfee Agent for Linux version 5.5.0 McAfee Agent for Linux version 5.5.1

Description The issue is related to a privilege escalation vulnerability that allows local users to perform arbitrary command execution under specific conditions. It is associated with errors in handling temporary files, which can be exploited to elevate privileges using a specially crafted request.

Recommendations For McAfee Agent for Linux versions 5.0.0 through 5.0.6, update to a version outside of this range to resolve the issue. For McAfee Agent for Linux version 5.5.0, update to a version outside of this range to resolve the issue. For McAfee Agent for Linux version 5.5.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to temporary files to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-377

Related Identifiers

BDU:2019-02372

CVE-2018-6704

Affected Products

Mcafee Agent For Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-6704 · Security Note
• https://bdu.fstec.ru/vul/2019-02372 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6704 · Vendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10259 · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10259 · Note