[ad_1]
McAfee has patched a safety vulnerability found within the firm’s McAfee Agent software program for Home windows enabling attackers to escalate privileges and execute arbitrary code with SYSTEM privileges.
McAfee Agent is a client-side part of McAfee ePolicy Orchestrator (McAfee ePO) that downloads and enforces endpoint insurance policies and deploys antivirus signatures, upgrades, patches, and new merchandise on enterprise endpoints.
The corporate has patched the excessive severity native privilege escalation (LPE) flaw tracked as CVE-2022-0166 and found by CERT/CC vulnerability analyst Will Dormann issued safety updates with the discharge of McAfee Agent 5.7.5 on January 18.
All McAfee Agent variations earlier than 5.7.5 are weak and permit unprivileged attackers to run code utilizing NT AUTHORITYSYSTEM account privileges, the best stage of privileges on a Home windows system, utilized by the OS and OS companies.
“McAfee Agent, which comes with varied McAfee merchandise similar to McAfee Endpoint Safety, consists of an OpenSSL part that specifies an OPENSSLDIR variable as a subdirectory that my be controllable by an unprivileged consumer on Home windows,” Dormann defined.
“McAfee Agent accommodates a privileged service that makes use of this OpenSSL part. A consumer who can place a specially-crafted openssl.cnf file at an applicable path could possibly obtain arbitrary code execution with SYSTEM privileges.”
Exploitable for evasion, loading malicious payloads
Following profitable exploitation, risk actors may persistently execute malicious payloads and probably evade detection throughout assaults.
Whereas solely exploitable domestically, risk actors generally exploit the sort of safety flaw throughout later phases of their assaults, after infiltrating the goal machine to raise permissions for gaining persistence and additional compromising the system.
This isn’t the primary time safety researchers have discovered vulnerabilities whereas analyzing McAfee’s Home windows safety merchandise.
As an example, in September 2021, the corporate patched one other McAfee Agent privilege escalation bug (CVE-2020-7315) found by Tenable safety researcher Clément Notin that allowed native customers to execute arbitrary code and kill the antivirus.
Two years earlier than, McAfee mounted a safety vulnerability impacting all editions of its Antivirus software program for Home windows (i.e., Whole Safety, Anti-Virus Plus, and Web Safety) and permitting potential attackers to escalate privileges and execute code with SYSTEM account authority.
[ad_2]
