McAfee VirusScan System Scan Local Privilege Escalation Vulnerability

Bugtraq ID:	11181
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 15 2004 12:00AM
Updated:	Sep 15 2004 12:00AM
Credit:	The discovery of this issue is credited to Ian Vitek.
Vulnerable:	McAfee VirusScan 4.5.1 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional McAfee VirusScan 4.5 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0
Not Vulnerable:

McAfee VirusScan System Scan Local Privilege Escalation Vulnerability

Reportedly McAfee VirusScan is affected by a local privilege escalation vulnerability. This issue is caused by a design error that causes the application to fail to drop SYSTEM privileges after acquiring them.

A local attacker may leverage this issue to escalate their privileges to SYSTEM on an affected Microsoft Windows computer.

** UPDATE: Additional versions later than 4.5.1 were added to this BID due to a report that a similar attack was possible against those versions. These versions have since been removed from the BID due to subsequent reports that indicated this attack was not possible against the reported versions.

McAfee VirusScan System Scan Local Privilege Escalation Vulnerability

No exploit is required to leverage this issue.

McAfee VirusScan System Scan Local Privilege Escalation Vulnerability

Solution:
This issue has reportedly been addressed by the vendor in Patch 48, which may be obtained by customers with a valid contract grant number through McAfee Corporate Technical Support.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

McAfee VirusScan System Scan Local Privilege Escalation Vulnerability

References:

• Corporate Technical Support (McAfee)
  
• RE: [Bugtraq] McAfee VirusScan Privilege Escalation Vulnerability (bashis )
  
• Re: [Bugtraq] McAfee VirusScan Privilege Escalation Vulnerability (bashis )
  
• RE: [Bugtraq] McAfee VirusScan Privilege Escalation Vulnerability [iDEFENSE] (Francis Favorini )
  
• VirusScan Product Homepage (McAfee)
  
• McAfee VirusScan Privilege Escalation Vulnerability [iDEFENSE] ("Jérôme" ATHIAS )