medium5.1Public exploit code

CVE-2016-3984

The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exch…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

McAfee VirusScan Enterprise 8.8 - Security Restrictions Bypass2016-03-07 · local · windows

Impact

The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL) before 2.0.1.140.1, Data Loss Prevention Endpoint (DLPe) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Device Control (MDC) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Endpoint Security (ENS) 10.x before 10.1, Host Intrusion Prevention Service (IPS) 8.0 before 8.0.0.3624, and VirusScan Enterprise (VSE) 8.8 before P7 (8.8.0.1528) on Windows allows local administrators to bypass intended self-protection rules and disable the antivirus engine by modifying registry keys.

Affected products

Vendor	Product	Affected versions
Mcafee	Active Response	through 1.1.0.158
Mcafee	Agent	through 5.0.2.285
Mcafee	Data Exchange Layer	through 2.0.0.430.1
Mcafee	Data Loss Prevention Endpoint	through 9.3.0 through 9.4.0
Mcafee	Endpoint Security	through 10.0.1
Mcafee	Host Intrusion Prevention	through 8.0.0
Mcafee	Virusscan Enterprise	through 8.8.0

Weakness classification

CWE-284

Public exploit code

Impact

Affected products

Weakness classification

References