QID 375633

McAfee Data Loss Prevention (DLP) for Windows allows a local, low privileged,
attacker through the use of junctions to cause the product to
load DLLs of the attacker's choosing. This requires the creation and removal of junctions
by the attacker along with sending a specific IOTL command at the correct time.

Affected Versions:
McAfee DLP Endpoint for Windows Prior to 11.6.100.0

QID Detection Logic:(Authenticated)
This QID checks for vulnerable version of McAfee Data Loss Prevention Endpoint by checking file version of fcag.exe.

On Successful attack it allows a local, low privileged, attacker through the use of junctions
to cause the product to load DLLs of the attacker's
choosing. This requires the creation and removal of junctions by the attacker along with
sending a specific IOTL command at the correct time.