SB2020091421 - Multiple vulnerabilities in McAfee Endpoint Security (ENS)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020091421

SB2020091421 - Multiple vulnerabilities in McAfee Endpoint Security (ENS)

Published: September 14, 2020

Security Bulletin ID SB2020091421
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Improper access control (CVE-ID: CVE-2020-7319)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A local user can access files which the user otherwise would not have access to via manipulating symbolic links to redirect McAfee file operations to an unintended file.

Note: This vulnerability affects the following versions:

  • 10.7.0.x
  • 10.6.x
  • 10.5.x


2) Improper Authentication (CVE-ID: CVE-2020-7323)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. An attacker with physical access can bypass the Windows lock screen via triggering certain detection events while the computer screen is locked and the McTray.exe is running with elevated privileges.

Note: This vulnerability affects the following versions:

  • 10.7.0.x
  • 10.6.x
  • 10.5.x

3) Information disclosure (CVE-ID: CVE-2020-7322)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A local administrator can gain unauthorized access to sensitive information on the system via incorrectly logging of sensitive information in debug logs.

Note: This vulnerability affects the following versions:

  • 10.7.0.x
  • 10.6.x
  • 10.5.x

4) Protection Mechanism Failure (CVE-ID: CVE-2020-7320)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures. A local administrator can temporarily reduce the detection capability allowing otherwise detected malware to run via stopping certain Microsoft services.

Note: This vulnerability affects the following versions:

  • 10.7.0.x
  • 10.6.x
  • 10.5.x

Remediation

Install update from vendor's website.

References