McAfee VirusScan WebScanX Code Execution Vulnerability

Bugtraq ID:	6288
Class:	Origin Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 02 2002 12:00AM
Updated:	Dec 02 2002 12:00AM
Credit:	Discovery is credited to Jari Helenius <[email protected]>.
Vulnerable:	McAfee VirusScan 4.5.1 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional
Not Vulnerable:

McAfee VirusScan WebScanX Code Execution Vulnerability

McAfee VirusScan's WebScanX component hooks into explorer.exe on Microsoft Windows systems. When explorer is used to browse directories (local or network), and the user's home directory is located on a network share, WebScanX calls several .dll files from the user's home directory.

If one of these called .dll files contained attacker-supplied code, it would be executed by WebScanX in the local System context.

McAfee VirusScan WebScanX Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.