Serious Security Vulnerability Found In All McAfee Antivirus Editions

  •  
  •  
  •  
  • 1
  •  
  •  
  •  
    1
    Share

Following Avast, we now hear of a security bug in McAfee antivirus. Researchers have found this vulnerability to affect all McAfee Antivirus Editions, the vulnerability could allow for code execution via DLL injection.

Vulnerability In McAfee Antivirus Editions

Researchers from SafeBreach Labs have discovered a serious security vulnerability affecting all Editions of McAfee Antivirus software. Elaborating on their findings in a report, Peleg Hadar stated that a potential attacker could exploit the vulnerability to achieve code execution.

As stated in the report,

We found that multiple services of the McAfee software which run as signed processes and as NT AUTHORITY\SYSTEM try to load c:\Windows\System32\wbem\wbemcomn.dll, which cannot be found (since it is actually located in System32 and not in the System32\Wbem folder).

An attacker could load an arbitrary unsigned DLL to these processes to execute code while evading defense mechanisms.

Researchers have also shared a PoC for the exploit. They could load DLL and execute code in multiple processes signed by McAfee.

The researchers suspect that the vulnerability could have allowed an attacker to execute malicious payloads, evade security checks, and bypass application whitelisting.

McAfee Released A Fix

Upon discovering the bug in August 2019, the researchers informed McAfee about the flaw. They noticed that this vulnerability, CVE-2019-3648, affected all versions of McAfee Total Protection (MTP), McAfee Anti-Virus Plus (AVP), and McAfee Internet Security (MIS) until v.16.0.R22.

Following their report, McAfee rolled out a fix for this vulnerability with the release of software version 16.0.R22 Refresh 1. Though, they have labeled this flaw as a medium severity vulnerability, with a CVSS base score of 6.1.

Users of affected versions of McAfee Antivirus software should hence ensure they update their systems to the latest patched versions.

Recently, Avast also made it to the news when a researcher found a cross-site scripting vulnerability affecting the Avast and AVG antivirus Desktop for Windows. Though, the vendors not only patched the flaw but also awarded the researcher $5000 as bounty.

Let us know your thoughts in the comments.

The following two tabs change content below.
Avatar

Abeerah Hashim

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]
Avatar

Abeerah Hashim

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]

Do NOT follow this link or you will be banned from the site!