PT-2021-19548 · Mcafee · Mcafee Agent For Windows

Kharosx0 · Published 2021-09-22 · Updated 2023-11-15 · CVE-2021-31847

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: McAfee Agent for Windows versions prior to 5.7.4

Description: The issue is related to improper access control in the repair process, allowing a local attacker to perform a DLL preloading attack using unsigned DLLs. This results in elevation of privileges and the ability to execute arbitrary code as the system user. The vulnerability occurs because a temporary directory used in the repair process is not correctly protected and the DLL signature is not checked.

Recommendations: For versions prior to 5.7.4, update to version 5.7.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the temporary directory used in the repair process to minimize the risk of exploitation. Additionally, ensure that all DLLs used by the McAfee Agent for Windows are properly signed and validated to prevent unsigned DLLs from being loaded.

Fix

Improper Verification of Cryptographic Signature

Improper Privilege Management

Uncontrolled Search Path Element

Weakness Enumeration

CWE-347

CWE-269

CWE-427

Related Identifiers

CVE-2021-31847

ZDI-21-1104

Affected Products

Mcafee Agent For Windows

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-31847 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-1104 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31847 · Vendor Advisory
• https://t.me/cvenotify/21297 · Telegram Post
• https://t.me/cibsecurity/29233 · Telegram Post
• https://kc.mcafee.com/corporate/index?page=content&id=SB10369 · Note