PT-2019-3998 · Mcafee · Mcafee Data Loss Prevention

Published 2019-07-23 · Updated 2020-10-16 · CVE-2019-3622

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions McAfee Data Loss Prevention (DLPe) for Windows versions prior to 11.3.0

Description The issue is related to insufficient access control in McAfee Data Loss Prevention Endpoint, allowing an authenticated user to redirect log files to arbitrary locations by creating symbolic links due to incorrect access control applied to the log folder. This can be exploited by a privileged user.

Recommendations For versions prior to 11.3.0, update to version 11.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the DLPe log folder to prevent privileged users from creating symbolic links until a patch is available.

Fix

Improper Access Control

Files Accessible to External Parties

Weakness Enumeration

CWE-284

CWE-552

Related Identifiers

BDU:2019-04529

CVE-2019-3622

Affected Products

Mcafee Data Loss Prevention

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2019-3622 · Security Note
• https://bdu.fstec.ru/vul/2019-04529 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3622 · Vendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10290 · Note
• http://securityfocus.com/bid/109370 · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SNS2088 · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10290 · Note
• https://docs.mcafee.com/bundle/data-loss-prevention-endpoint-windows-11.3.x-release-notes/page/GUID-C06A7691-425A-476C-BB1C-9D8BB291BCE8.html · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SNS2088 · Note