SSD Advisory – McAfee LiveSafe MiTM Registry Modification leading to Remote Command Execution

[Maor Shwartz <maors () beyondsecurity com>]

SSD Advisory – McAfee LiveSafe MiTM Registry Modification leading to Remote
Command Execution

Full report: https://blogs.securiteam.com/index.php/archives/3248
Twitter: @SecuriTeam_SSD
Weibo: SecuriTeam_SSD

Vulnerabilities Summary
The following advisory describes a Remote Code Execution found in McAfee
McAfee LiveSafe (MLS) versions prior to 16.0.3. The vulnerability allows
network attackers to modify the Windows registry value associated with the
McAfee update via the HTTP backend-response.

McAfee Security Scan Plus is a free diagnostic tool that ensures you are
protected from threats by actively checking your computer for up-to-date
anti-virus, firewall, and web security software. It also scans for threats
in any open programs.

Credit
An independent security research company, Silent Signal, has reported this
vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

Vendor response
The vendor has released patches to address this vulnerability.

For more information:
https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102714

CVE: CVE-2017-3898

--
Thanks
Maor Shwartz
Beyond Security
GPG Key ID: 93CC36E2DE7FF514

Attachment: SSD Advisory – McAfee LiveSafe MiTM Registry Modification leading to Remote Command Execution – SecuriTeam Blogs.pdf
Description:

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/