vulnwire
5.1med

CVE-2016-39841 exploit

The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5…

Published 10 y ago · modified 4 mo ago · JSON

CVSS
5.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.1%
percentile 65%
Public exploits
1
Exploit-DB

The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL) before 2.0.1.140.1, Data Loss Prevention Endpoint (DLPe) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Device Control (MDC) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Endpoint Security (ENS) 10.x before 10.1, Host Intrusion Prevention Service (IPS) 8.0 before 8.0.0.3624, and VirusScan Enterprise (VSE) 8.8 before P7 (8.8.0.1528) on Windows allows local administrators to bypass intended self-protection rules and disable the antivirus engine by modifying registry keys.

Exploit prediction (EPSS)

1.08% probability of exploitation in the next 30 days, higher than 65% of all scored CVEs.

Exploits and detections

  • EDB-39531 McAfee VirusScan Enterprise 8.8 - Security Restrictions Bypass · local · 2016-03-07

CVSS scores

Assigned byVersionScoreVector
NVD3.05.1CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
NVD2.03.6AV:L/AC:L/Au:N/C:N/I:P/A:P

Classification

Weakness

References

  • seclists.org /fulldisclosure/2016/Mar/13 · mailing-list, x_refsource_FULLDISC, x_transferred
  • lab.mediaservice.net /advisory/2016-01-mcafee.txt · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/39531/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • securitytracker.com /id/1035130 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • kc.mcafee.com /corporate/index?page=content&id=SB10151 · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.