McAfee Security Installer Control System ActiveX Information Disclosure Vulnerability

Bugtraq ID:	10236
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 29 2004 12:00AM
Updated:	Apr 29 2004 12:00AM
Credit:	Discovery is credited to Jonathan Payne.
Vulnerable:	McAfee Security Installer Control System 4.0 .0.81 + McAfee VirusScan 4.5.1 + McAfee VirusScan 4.5 + McAfee VirusScan 4.0.3
Not Vulnerable:

McAfee Security Installer Control System ActiveX Information Disclosure Vulnerability

The McAfee Security Installer Control System ActiveX control is prone to a vulnerability that may reveal sensitive system information remotely.

This control is marked "Safe for Scripting" and provides remotely accessible methods for querying the host system's registry. As a result, a malicious web page or HTML e-mail that invokes the control may gain access to information in the registry on a client system that has the control installed.

McAfee Security Installer Control System ActiveX Information Disclosure Vulnerability

There is no exploit required.

McAfee Security Installer Control System ActiveX Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

McAfee Security Installer Control System ActiveX Information Disclosure Vulnerability

References:

• McAfee Homepage (McAfee)