Twenty Year Anniversary

McAfee VirusScan Enterprise 8.8 Security Bypass

McAfee VirusScan Enterprise 8.8 Security Bypass
Posted Mar 5, 2016
Authored by Maurizio Agazzini

McAfee VirusScan Enterprise versions 8.8 and below suffer from a security restrictions bypass vulnerability.

tags | exploit, bypass
MD5 | cce402391275681076c310ea79fe77a1

McAfee VirusScan Enterprise 8.8 Security Bypass

Change Mirror Download
Security Advisory       @ Mediaservice.net Srl
(#01, 13/04/2016) Data Security Division

Title: McAfee VirusScan Enterprise security restrictions bypass
Application: McAfee VirusScan Enterprise 8.8 and prior versions
Platform: Microsoft Windows
Description: A local Windows administrator is able to bypass the
security restrictions and disable the antivirus engine
without knowing the correct management password
Author: Maurizio Agazzini <inode@mediaservice.net>
Vendor Status: Fixed
References: http://lab.mediaservice.net/advisory/2016-01-mcafee.txt
http://lab.mediaservice.net/code/mcafee_unprotector.c

1. Abstract.

McAfee VirusScan Enterprise has a feature to protect the scan engine
from local Windows administrators. A management password is needed to
disable it, unless Windows is running in "Safe Mode".

>From our understanding this feature is implemented insecurely: the
McAfee VirusScan Console checks the password and requests the engine to
unlock the safe registry keys. No checks are done by the engine itself,
so anyone can directly request the engine to stop without knowing the
correct management password.

2. Example Attack Session.

The attack can be reproduced in different ways, here are some examples.

Example 1:

Open the McAfee VirusScan Console and Sysinternals Process Explorer.

Under Process Explorer:

- Locate the mcconsol.exe process
- Type CTRL+L (show lower pane)
- Search for all "HKLM\SOFTWARE\McAfee\DesktopProtection" keys
- Close all the handles of this registry key

Go back to the McAfee Console and:

- Go to: Tools -> General Options
- Select the "Password Options" tab
- Select "No password" and apply settings

Now it is possible to stop the antivirus engine.

Example 2:

A specific tool has been written to request to disable password
protection. After running the tool you can disable it via the VirusScan
Console.

Code: http://lab.mediaservice.net/code/mcafee_unprotector.c

3. Affected Platforms.

All McAfee Viruscan Enterprise versions prior to 8.8 without SB10151 are
affected. Exploitation of this vulnerability requires that an attacker
has local Windows administrator privileges.

4. Fix.

On 25 February 2016, version SB10151 hotfix has been relased by McAfee,
which fixes the described vulnerability.

https://kc.mcafee.com/corporate/index?page=content&id=SB10151

5. Proof Of Concept.

See Example Attack Session above.

6. Timeline

07/11/2014 - First communication sent to McAfee
17/11/2014 - Second communication sent to McAfee
17/11/2014 - McAfee: Request to send again vulnerability information
18/11/2014 - Sent vulnerability information and PoC again
11/12/2014 - McAfee: Problem confirmed
09/03/2015 - Request for update to McAfee
06/05/2015 - Request for update to McAfee
06/05/2015 - McAfee: Patch release planned for Q3
20/08/2015 - McAfee: Request for deadline delay (31/03/2016)
25/02/2016 - McAfee: SB10151 patch has been relased

Copyright (c) 2014-2016 @ Mediaservice.net Srl. All rights reserved.

--
Maurizio Agazzini CISSP, CSSLP, OPST
Senior Security Advisor
@ Mediaservice.net Srl Tel: +39-011-32.72.100
Via Santorelli, 15 Fax: +39-011-32.46.497
10095 Grugliasco (TO) ITALY http://mediaservice.net/disclaimer

"C programmers never die. They are just cast into void"

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

May 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    15 Files
  • 2
    May 2nd
    17 Files
  • 3
    May 3rd
    30 Files
  • 4
    May 4th
    29 Files
  • 5
    May 5th
    2 Files
  • 6
    May 6th
    3 Files
  • 7
    May 7th
    13 Files
  • 8
    May 8th
    27 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    15 Files
  • 11
    May 11th
    8 Files
  • 12
    May 12th
    2 Files
  • 13
    May 13th
    8 Files
  • 14
    May 14th
    7 Files
  • 15
    May 15th
    43 Files
  • 16
    May 16th
    19 Files
  • 17
    May 17th
    16 Files
  • 18
    May 18th
    15 Files
  • 19
    May 19th
    3 Files
  • 20
    May 20th
    6 Files
  • 21
    May 21st
    15 Files
  • 22
    May 22nd
    3 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close