McAfee Scan Engine 5.400.0.1158 Malware Detection access control
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
4.7 | $5k-$25k | 0.00 |
A vulnerability classified as critical has been found in McAfee Scan Engine 5.400.0.1158. This affects some unknown processing of the component Malware Detection. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on integrity. The summary by CVE is:
The ELF file parser in AhnLab V3 Internet Security 2011.01.18.00, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, McAfee Anti-Virus Scanning Engine 5.400.0.1158, Norman Antivirus 6.06.12, nProtect Anti-Virus 2011-01-17.01, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified endianness field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations.
The weakness was disclosed 03/21/2012 by Suman Jana (Website). It is possible to read the advisory at securityfocus.com. This vulnerability is uniquely identified as CVE-2012-1463 since 02/29/2012. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/30/2018). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.
There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.
The vulnerability is also documented in the vulnerability database at X-Force (74311). The entries 60506, 60505, 60504 and 60503 are pretty similar.
Product
Vendor
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.3VulDB Meta Temp Score: 4.7
VulDB Base Score: 5.3
VulDB Temp Score: 4.7
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Access controlCWE: CWE-264
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Status: Unproven
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: no mitigation knownStatus: 🔍
0-Day Time: 🔍
Timeline
02/29/2012 🔍03/20/2012 🔍
03/21/2012 🔍
03/21/2012 🔍
03/23/2015 🔍
01/30/2018 🔍
Sources
Vendor: mcafee.comAdvisory: securityfocus.com⛔
Researcher: Suman Jana
Status: Not defined
CVE: CVE-2012-1463 (🔍)
X-Force: 74311 - Multiple Antivirus Products ELF file evasion
SecurityFocus: 52614 - Multiple AntiVirus Products CVE-2012-1463 ELF File Scan Evasion Vulnerability
OSVDB: 80426
See also: 🔍
Entry
Created: 03/23/2015 16:50Updated: 01/30/2018 10:16
Changes: 03/23/2015 16:50 (51), 01/30/2018 10:16 (5)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.