SB2020091421 - Multiple vulnerabilities in McAfee Endpoint Security (ENS)

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Improper access control (CVE-ID: CVE-2020-7319)

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A local user can access files which the user otherwise would not have access to via manipulating symbolic links to redirect McAfee file operations to an unintended file.

Note: This vulnerability affects the following versions:

• 10.7.0.x
• 10.6.x
• 10.5.x

2) Improper Authentication (CVE-ID: CVE-2020-7323)

The vulnerability allows a local attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. An attacker with physical access can bypass the Windows lock screen via triggering certain detection events while the computer screen is locked and the McTray.exe is running with elevated privileges.

Note: This vulnerability affects the following versions:

• 10.7.0.x
• 10.6.x
• 10.5.x

3) Information disclosure (CVE-ID: CVE-2020-7322)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A local administrator can gain unauthorized access to sensitive information on the system via incorrectly logging of sensitive information in debug logs.

Note: This vulnerability affects the following versions:

• 10.7.0.x
• 10.6.x
• 10.5.x

4) Protection Mechanism Failure (CVE-ID: CVE-2020-7320)

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures. A local administrator can temporarily reduce the detection capability allowing otherwise detected malware to run via stopping certain Microsoft services.

Note: This vulnerability affects the following versions:

• 10.7.0.x
• 10.6.x
• 10.5.x

Remediation

Install update from vendor's website.

References

• https://kc.mcafee.com/corporate/index?page=content&id=SB10327