McAfee VirusScan Command Line Updater Script Insecure Temporary File Creation Vulnerability

Bugtraq ID:	45716
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 07 2011 12:00AM
Updated:	Jan 07 2011 12:00AM
Credit:	Technion
Vulnerable:	McAfee VirusScan Command Line 6.0
Not Vulnerable:

McAfee VirusScan Command Line Updater Script Insecure Temporary File Creation Vulnerability

McAfee VirusScan Command Line creates temporary files in an insecure manner.

An attacker could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application. Other attacks may also be possible.

McAfee VirusScan Command Line 6.0 is vulnerable; other versions may also be affected.

McAfee VirusScan Command Line Updater Script Insecure Temporary File Creation Vulnerability

An attacker can use readily available commands to exploit this issue.

McAfee VirusScan Command Line Updater Script Insecure Temporary File Creation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

McAfee VirusScan Command Line Updater Script Insecure Temporary File Creation Vulnerability

References:

• Downloading the AVV-Dat package for use with VirusScan Command Line 6.0 (VSCL) (McAfee)