McAfee SecurityCenter Buffer Overflow Lets Remote Users Execute Arbitrary Commands
|
|
SecurityTracker Alert ID: 1016614
|
|
SecurityTracker URL: http://securitytracker.com/id?1016614
|
|
CVE Reference: CVE-2006-3961
(Links to External Site)
|
Updated: Aug 8 2006
|
Original Entry Date: Aug 1 2006
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: eEye Digital Security
|
Version(s): 6.0.22 and prior versions
|
Description: A vulnerability was reported in McAfee SecurityCenter. A remote user can execute arbitrary commands on the target system. Several McAfee products are affected.
The Subscription Manager ActiveX control ('McSubMgr.dll') contains a stack overflow. A remote user can create HTML that references
the control by its CLSID and that, when loaded by the target user, will execute arbitrary commands on the target user's system.
The
following other McAfee products include the vulnerable component and are also vulnerable:
McAfee AntiSpyware 1.x, 2.x
McAfee
Internet Security Suite 6.x, 7.x, 8.x
McAfee Personal Firewall Plus 5.x, 6.x, 7.x
McAfee Privacy Service 6.x, 7.x, 8.x
McAfee
QuickClean 4.x, 5.x, 6.x
McAfee SpamKiller 5.x, 6.x, 7.x
McAfee VirusScan 8.x, 9.x, 10.x
McAfee Wireless Home Network Security
1.x
The vendor was notified on July 19, 2006.
Karl Lynn of eEye Digital Security discovered this vulnerability.
The original
advisory is available at:
http://www.eeye.com/html/research/advisories/AD2006807.html
|
Impact: A remote user can execute arbitrary commands on the target system.
|
Solution: The vendor has issued a fixed version of McAfee SecurityCenter (6.0.23).
The McAfee advisory is available at:
http://ts.mcafeehelp.com/faq3.asp?docid=407052
|
Vendor URL: www.mcafee.com/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 1 Aug 2006 02:15:00 -0400
Subject: EEYEB-20060719 McAfee VirusScan and other product vulnerabilities
|
http://www.eeye.com/html/research/upcoming/20060719.html
Affected products include:
McAfee Internet Security Suite 2006
McAfee Wireless Home Network Security
McAfee Personal Firewall Plus
McAfee VirusScan
McAfee Privacy Service
McAfee SpamKiller
McAfee AntiSpyware
|
|
