PT-2019-3087 · Mcafee · Mcafee Data Loss Prevention Endpoint

Published 2019-07-23 · Updated 2020-10-16 · CVE-2019-3595

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions McAfee Data Loss Prevention Endpoint versions prior to 11.3.0

Description The issue is related to insufficient argument validation in a command, which can be exploited to execute arbitrary code. This can be achieved through a specially crafted DLP policy that is exported and opened on the local machine, allowing an authenticated administrator to execute code with their local machine privileges. The user must explicitly allow the code to execute.

Recommendations For versions prior to 11.3.0, update to version 11.3.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of DLP policies to minimize the risk of exploitation. Avoid opening specially crafted DLP policies on local machines until the issue is resolved.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

BDU:2019-03070

CVE-2019-3595

Affected Products

Mcafee Data Loss Prevention Endpoint

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2019-3595 · Security Note
• https://bdu.fstec.ru/vul/2019-03070 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3595 · Vendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10289 · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SNS2088 · Note
• http://securityfocus.com/bid/109377 · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10289 · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SNS2088 · Note