PT-2021-19546 · Mcafee · Mcafee Data Loss Prevention Endpoint

Published 2021-09-17 · Updated 2023-11-15 · CVE-2021-31844

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: McAfee Data Loss Prevention (DLP) Endpoint for Windows versions prior to 11.6.200

Description: A buffer overflow issue allows a local attacker to execute arbitrary code with elevated privileges by placing carefully constructed Ami Pro (.sam) files onto the local system and triggering a DLP Endpoint scan through accessing a file. This is caused by the destination buffer being of fixed size and incorrect checks being made on the source size.

Recommendations: For versions prior to 11.6.200, update to version 11.6.200 or later to resolve the issue. As a temporary workaround, consider restricting access to Ami Pro (.sam) files to minimize the risk of exploitation. Avoid triggering DLP Endpoint scans on potentially malicious files until the issue is resolved.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2021-31844

Affected Products

Mcafee Data Loss Prevention Endpoint

References · 6

• https://osv.dev/vulnerability/CVE-2021-31844 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31844 · Security Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10368 · Note
• https://t.me/cvenotify/21092 · Telegram Post
• https://t.me/cvenotify/21729 · Telegram Post
• https://t.me/cibsecurity/29047 · Telegram Post