full-disclosure - [FD] SSD Advisory – McAfee LiveSafe MiTM Registry Modification leading to Remote Command Execution

Open Source and information security mailing list archives

Message-ID: <CAAnZqX_uUzfNHAoGhO24czG8sLPp9O7XizFf3RW=KnvntJ5jHg@mail.gmail.com>
Date: Thu, 7 Sep 2017 09:21:37 +0300
From: Maor Shwartz <maors@...ondsecurity.com>
To: fulldisclosure@...lists.org
Cc: SecuriTeam Secure Disclosure <ssd@...ondsecurity.com>
Subject: [FD] SSD Advisory – McAfee LiveSafe MiTM Registry Modification leading to Remote Command Execution

SSD Advisory – McAfee LiveSafe MiTM Registry Modification leading to Remote
Command Execution

Full report: https://blogs.securiteam.com/index.php/archives/3248
Twitter: @SecuriTeam_SSD
Weibo: SecuriTeam_SSD

Vulnerabilities Summary
The following advisory describes a Remote Code Execution found in McAfee
McAfee LiveSafe (MLS) versions prior to 16.0.3. The vulnerability allows
network attackers to modify the Windows registry value associated with the
McAfee update via the HTTP backend-response.

McAfee Security Scan Plus is a free diagnostic tool that ensures you are
protected from threats by actively checking your computer for up-to-date
anti-virus, firewall, and web security software. It also scans for threats
in any open programs.

Credit
An independent security research company, Silent Signal, has reported this
vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

Vendor response
The vendor has released patches to address this vulnerability.

For more information:
https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102714

CVE: CVE-2017-3898

--
Thanks
Maor Shwartz
Beyond Security
GPG Key ID: 93CC36E2DE7FF514

Download attachment "SSD Advisory – McAfee LiveSafe MiTM Registry Modification leading to Remote Command Execution – SecuriTeam Blogs.pdf" of type "application/pdf" (131354 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives