Mcafee FreeScan CoMcFreeScan Browser Information Disclosure Vulnerability

Bugtraq ID:	10077
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 07 2004 12:00AM
Updated:	Apr 07 2004 12:00AM
Credit:	This issue has been independently discovered by S G Masood <[email protected]> and Rafel Ivgi, The-Insider <[email protected]>.
Vulnerable:	McAfee FreeScan
Not Vulnerable:

Mcafee FreeScan CoMcFreeScan Browser Information Disclosure Vulnerability

Reportedly the Mcafee FreeScan 'McFreeScan.CoMcFreeScan.1' COM object is prone to a remote information disclosure vulnerability. This issue is due to a failure of the object to properly validate information access credentials.

Successful exploitation of this issue may provide an attacker with sensitive system information. The provided system information may be used to carry out further attacks against the affected system.

Mcafee FreeScan CoMcFreeScan Browser Information Disclosure Vulnerability

The following proof of concept script has been provided:

• /data/vulnerabilities/exploits/mcafeeInfDisclosurePOC.txt

Mcafee FreeScan CoMcFreeScan Browser Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Mcafee FreeScan CoMcFreeScan Browser Information Disclosure Vulnerability

References:

• Mcafee FreeScan (McAfee)
  
• Mcafee FreeScan - Remote Buffer Overflow and Private Information Disclosure ("Rafel Ivgi, The-Insider" )
  
• McAfee Freescan ActiveX Information Disclosure [Additional Details & PoC] (S G Masood )