Vulnerabilites related to McAfee - VirusScan Enterprise
var-200904-0511
Vulnerability from variot
The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive. Multiple McAfee products are prone to a vulnerability that may allow certain compressed archives to bypass the scan engine. Successful exploits will allow attackers to distribute files containing malicious code that the antivirus application will fail to detect. The issue affects all McAfee software that uses DAT files. ----------------------------------------------------------------------
Secunia is pleased to announce the release of the annual Secunia report for 2008.
Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics
Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/
Stay Secure,
Secunia
TITLE: McAfee Products Archive Handling Security Bypass
SECUNIA ADVISORY ID: SA34949
VERIFY ADVISORY: http://secunia.com/advisories/34949/
DESCRIPTION: Some weaknesses have been reported in various McAfee products, which can be exploited by malware to bypass the scanning functionality.
The weaknesses are caused due to errors in the handling of archive file formats (e.g.
SOLUTION: Update .DAT files to DAT 5600 or later. http://www.mcafee.com/apps/downloads/security_updates/dat.asp
PROVIDED AND/OR DISCOVERED BY: * Thierry Zoller * The vendor also credits Mickael Roger.
ORIGINAL ADVISORY: McAfee: https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENT
Thierry Zoller: http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. ____________
From the low-hanging-fruit-department - Mcafee multiple generic evasions
Release mode: Coordinated but limited disclosure. Ref : TZO-182009 - Mcafee multiple generic evasions WWW : http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html Vendor : http://www.mcafee.com Status : Patched CVE : CVE-2009-1348 (provided by mcafee) https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENT
Security notification reaction rating : very good Notification to patch window : +-27 days (Eastern holidays in between)
Disclosure Policy : http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html
Affected products : - McAfee VirusScan\xae Plus 2009 - McAfee Total Protection\x99 2009 - McAfee Internet Security - McAfee VirusScan USB - McAfee VirusScan Enterprise - McAfee VirusScan Enterprise Linux - McAfee VirusScan Enterprise for SAP - McAfee VirusScan Enterprise for Storage - McAfee VirusScan Commandline - Mcafee SecurityShield for Microsoft ISA Server - Mcafee Security for Microsoft Sharepoint - Mcafee Security for Email Servers - McAfee Email Gateyway - McAfee Total Protection for Endpoint - McAfee Active Virus Defense - McAfee Active VirusScan
It is unkown whether SaaS were affected (tough likely) : - McAfee Email Security Service - McAfee Total Protection Service Advanced
I. Background ~~~~~~~~~~~~~ Quote: "McAfee proactively secures systems and networks from known and as yet undiscovered threats worldwide. Home users, businesses, service providers, government agencies, and our partners all trust our unmatched security expertise and have confidence in our comprehensive and proven solutions to effectively block attacks and prevent disruptions."
II. Description ~~~~~~~~~~~~~~~ The parsing engine can be bypassed by a specially crafted and formated RAR (Headflags and Packsize),ZIP (Filelenght) archive.
III. Impact ~~~~~~~~~~~ A general description of the impact and nature of AV Bypasses/evasions can be read at : http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html
The bug results in denying the engine the possibility to inspect code within RAR and ZIP archives. There is no inspection of the content at all and hence the impossibility to detect malicious code.
IV. Disclosure timeline ~~~~~~~~~~~~~~~~~~~~~~~~~ DD/MM/YYYY 04/04/2009 : Send proof of concept RAR I, description the terms under which I cooperate and the planned disclosure date
06/04/2009 : Send proof of concept RAR II, description the terms under which I cooperate and the planned disclosure date
06/04/2009 : Mcafee acknowledges receipt and reproduction of RAR I, ack acknowledges receipt of RARII
10/04/2009 : Send proof of concept ZIP I, description the terms under which I cooperate and the planned disclosure date
21/04/2009 : Mcafee provides CVE number CVE-2009-1348
28/04/2009 : Mcafee informs me that the patch might be released on the 29th 29/04/2009 : Mcafee confirms patch release and provides URL https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENT
29/04/2009 : Ask for affected versions
29/04/2009 : Mcafee replies " This issue does affect all vs engine products, including both gateway and endpoint"
Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/. Description ~~~~~~~~~~~~~~~ Improper parsing of the PDF structure leads to evasion of detection of malicious PDF documents at scantime and runtime.
This has been tested with several malicious PDF files and represents a generic evasion of all PDF signatures and heuristics.
General information about evasion/bypasses can be found at : http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html
III. Impact ~~~~~~~~~~~ Known PDF exploits/malware may evade signature detection, 0day exploits may evade heuristics. Disclosure timeline ~~~~~~~~~~~~~~~~~~~~~~~~~ DD.MM.YYYY 01.06.2009 - Reported 20.10.2009 - McAfee informed us that they published the advisory on their website < waiting for others vendors to patch > 27.10.2009 - G-SEC releases this advisory
About G-SEC ~~~~~~~~~~~ G-SEC\x99 is a vendor independent luxemburgish led IT security consulting group. More information available at : http://www.g-sec.lu/
Full-Disclosure - We believe in it. ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability intelligence source on the market.
Implement it through Secunia
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200904-0511",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "securityshield for microsoft isa server",
"scope": null,
"trust": 1.7,
"vendor": "mcafee",
"version": null
},
{
"model": "active virusscan",
"scope": null,
"trust": 1.7,
"vendor": "mcafee",
"version": null
},
{
"model": "active virus defense",
"scope": null,
"trust": 1.7,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan enterprise",
"scope": "eq",
"trust": 1.6,
"vendor": "mcafee",
"version": null
},
{
"model": "email gateway",
"scope": null,
"trust": 1.4,
"vendor": "mcafee",
"version": null
},
{
"model": "total protection for endpoint",
"scope": null,
"trust": 1.4,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan plus",
"scope": "eq",
"trust": 1.3,
"vendor": "mcafee",
"version": "2009"
},
{
"model": "total protection",
"scope": "eq",
"trust": 1.3,
"vendor": "mcafee",
"version": "2009"
},
{
"model": "virusscan command line",
"scope": null,
"trust": 1.1,
"vendor": "mcafee",
"version": null
},
{
"model": "total protection for endpoint",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "virusscan enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "internet security suite",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "2005"
},
{
"model": "virusscan commandline",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "active virus defense",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "securityshield for microsoft sharepoint",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "internet security suite",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "2004"
},
{
"model": "virusscan usb",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "active virusscan",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "internet security suite",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "2006"
},
{
"model": "internet security suite",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "2009"
},
{
"model": "securityshield for email servers",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "securityshield for microsoft isa server",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "internet security suite",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "email gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "internet security suite",
"scope": null,
"trust": 0.8,
"vendor": "mcafee",
"version": null
},
{
"model": "security for email servers",
"scope": null,
"trust": 0.8,
"vendor": "mcafee",
"version": null
},
{
"model": "security for microsoft sharepoint",
"scope": null,
"trust": 0.8,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan enterprise",
"scope": null,
"trust": 0.8,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan plus",
"scope": null,
"trust": 0.8,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan usb",
"scope": null,
"trust": 0.8,
"vendor": "mcafee",
"version": null
},
{
"model": "total protection",
"scope": null,
"trust": 0.8,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan enterprise",
"scope": "eq",
"trust": 0.6,
"vendor": "mcafee",
"version": "0"
},
{
"model": "securityshield for email servers",
"scope": null,
"trust": 0.6,
"vendor": "mcafee",
"version": null
},
{
"model": "securityshield for microsoft sharepoint",
"scope": null,
"trust": 0.6,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan commandline",
"scope": null,
"trust": 0.6,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan plus",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "20070"
},
{
"model": "virusscan enterprise i patch",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "8.015"
},
{
"model": "virusscan enterprise i patch",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "8.012"
},
{
"model": "virusscan enterprise i patch",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "8.011"
},
{
"model": "virusscan enterprise i",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "8.0"
},
{
"model": "virusscan enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "8.0"
},
{
"model": "virusscan enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "7.1"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "2006"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "2005"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "2004"
},
{
"model": "virex",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "7.7"
},
{
"model": "virex",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "total protection",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "20070"
},
{
"model": "portalshield for microsoft sharepoint",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "netshield for netware",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "4"
},
{
"model": "netshield for netware",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "linuxshield",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "1"
},
{
"model": "linuxshield",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "groupshield for lotus domino on windows",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "5"
},
{
"model": "groupshield for lotus domino on aix",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "5"
},
{
"model": "groupshield for lotus domino",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "7"
},
{
"model": "groupshield for lotus domino",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "5.55.0.964.1"
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "5.55.0.902.1"
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "5.55.0.1007.1"
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "20005"
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "6.0"
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "5.5"
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "6.0.616.102"
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "4"
},
{
"model": "virusscan usb",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "virusscan professional",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "virusscan enterprise for storage",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "virusscan enterprise for sap",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "total protection for endpoint",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "total protection",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "security for microsoft sharepoint",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "security for email servers",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "internet security",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "email gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
}
],
"sources": [
{
"db": "BID",
"id": "36848"
},
{
"db": "BID",
"id": "34780"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"db": "CNNVD",
"id": "CNNVD-200904-560"
},
{
"db": "NVD",
"id": "CVE-2009-1348"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:mcafee:active_virus_defense",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:mcafee:active_virusscan",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:mcafee:email_gateway",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:mcafee:internet_security_suite",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:mcafee:securityshield_for_email_servers",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:mcafee:securityshield_for_microsoft_sharepoint",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:mcafee:securityshield_for_microsoft_isa_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:mcafee:total_protection_for_endpoint",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:mcafee:virusscan_commandline",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:mcafee:virusscan_enterprise",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:mcafee:virusscan_plus",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:mcafee:virusscan_usb",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:mcafee:total_protection",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Thierry Zoller and Mickael Roger",
"sources": [
{
"db": "BID",
"id": "34780"
},
{
"db": "CNNVD",
"id": "CNNVD-200904-560"
}
],
"trust": 0.9
},
"cve": "CVE-2009-1348",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 7.6,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 4.9,
"id": "CVE-2009-1348",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.6,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 4.9,
"id": "VHN-38794",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:H/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2009-1348",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2009-1348",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-200904-560",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-38794",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-38794"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"db": "CNNVD",
"id": "CNNVD-200904-560"
},
{
"db": "NVD",
"id": "CVE-2009-1348"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive. Multiple McAfee products are prone to a vulnerability that may allow certain compressed archives to bypass the scan engine. \nSuccessful exploits will allow attackers to distribute files containing malicious code that the antivirus application will fail to detect. \nThe issue affects all McAfee software that uses DAT files. ----------------------------------------------------------------------\n\nSecunia is pleased to announce the release of the annual Secunia\nreport for 2008. \n\nHighlights from the 2008 report:\n * Vulnerability Research\n * Software Inspection Results\n * Secunia Research Highlights\n * Secunia Advisory Statistics\n\nRequest the full 2008 Report here:\nhttp://secunia.com/advisories/try_vi/request_2008_report/\n\nStay Secure,\n\nSecunia\n\n\n----------------------------------------------------------------------\n\nTITLE:\nMcAfee Products Archive Handling Security Bypass\n\nSECUNIA ADVISORY ID:\nSA34949\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/34949/\n\nDESCRIPTION:\nSome weaknesses have been reported in various McAfee products, which\ncan be exploited by malware to bypass the scanning functionality. \n\nThe weaknesses are caused due to errors in the handling of archive\nfile formats (e.g. \n\nSOLUTION:\nUpdate .DAT files to DAT 5600 or later. \nhttp://www.mcafee.com/apps/downloads/security_updates/dat.asp\n\nPROVIDED AND/OR DISCOVERED BY:\n* Thierry Zoller\n* The vendor also credits Mickael Roger. \n\nORIGINAL ADVISORY:\nMcAfee:\nhttps://kc.mcafee.com/corporate/index?page=content\u0026id=SB10001\u0026actp=LIST_RECENT\n\nThierry Zoller:\nhttp://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. ________________________________________________________________________\n\nFrom the low-hanging-fruit-department - Mcafee multiple generic evasions\n________________________________________________________________________\n\nRelease mode: Coordinated but limited disclosure. \nRef : TZO-182009 - Mcafee multiple generic evasions\nWWW : http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html\nVendor : http://www.mcafee.com\nStatus : Patched\nCVE : CVE-2009-1348 (provided by mcafee)\nhttps://kc.mcafee.com/corporate/index?page=content\u0026id=SB10001\u0026actp=LIST_RECENT\n\nSecurity notification reaction rating : very good\nNotification to patch window : +-27 days (Eastern holidays in between)\n\nDisclosure Policy : \nhttp://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html\n\nAffected products : \n- McAfee VirusScan\\xae Plus 2009\n- McAfee Total Protection\\x99 2009\n- McAfee Internet Security\n- McAfee VirusScan USB\n- McAfee VirusScan Enterprise\n- McAfee VirusScan Enterprise Linux\n- McAfee VirusScan Enterprise for SAP\n- McAfee VirusScan Enterprise for Storage\n- McAfee VirusScan Commandline\n- Mcafee SecurityShield for Microsoft ISA Server\n- Mcafee Security for Microsoft Sharepoint\n- Mcafee Security for Email Servers\n- McAfee Email Gateyway\n- McAfee Total Protection for Endpoint\n- McAfee Active Virus Defense\n- McAfee Active VirusScan\n \nIt is unkown whether SaaS were affected (tough likely) :\n- McAfee Email Security Service\n- McAfee Total Protection Service Advanced\n\n\nI. Background\n~~~~~~~~~~~~~\nQuote: \"McAfee proactively secures systems and networks from known \nand as yet undiscovered threats worldwide. Home users, businesses, \nservice providers, government agencies, and our partners all trust \nour unmatched security expertise and have confidence in our \ncomprehensive and proven solutions to effectively block attacks\nand prevent disruptions.\"\n\n\nII. Description\n~~~~~~~~~~~~~~~\nThe parsing engine can be bypassed by a specially crafted and formated\nRAR (Headflags and Packsize),ZIP (Filelenght) archive. \n\nIII. Impact\n~~~~~~~~~~~\nA general description of the impact and nature of AV Bypasses/evasions\ncan be read at : \nhttp://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html\n\nThe bug results in denying the engine the possibility to inspect\ncode within RAR and ZIP archives. There is no inspection of the content\nat all and hence the impossibility to detect malicious code. \n\n\nIV. Disclosure timeline\n~~~~~~~~~~~~~~~~~~~~~~~~~\nDD/MM/YYYY\n04/04/2009 : Send proof of concept RAR I, description the terms under which \n I cooperate and the planned disclosure date\n \n06/04/2009 : Send proof of concept RAR II, description the terms under which \n I cooperate and the planned disclosure date\n \n06/04/2009 : Mcafee acknowledges receipt and reproduction of RAR I, ack\n acknowledges receipt of RARII \n \n10/04/2009 : Send proof of concept ZIP I, description the terms under which \n I cooperate and the planned disclosure date\n\n21/04/2009 : Mcafee provides CVE number CVE-2009-1348 \n \n28/04/2009 : Mcafee informs me that the patch might be released on the 29th\n29/04/2009 : Mcafee confirms patch release and provides URL\n https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10001\u0026actp=LIST_RECENT\n \n29/04/2009 : Ask for affected versions\n\n29/04/2009 : Mcafee replies \" This issue does affect all vs engine products, including \n both gateway and endpoint\"\n\n\n\n\n\n_______________________________________________\nFull-Disclosure - We believe in it. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/. Description\n~~~~~~~~~~~~~~~\nImproper parsing of the PDF structure leads to evasion of detection of \nmalicious PDF documents at scantime and runtime. \n \nThis has been tested with several malicious PDF files and represents\na generic evasion of all PDF signatures and heuristics. \n\nGeneral information about evasion/bypasses can be found at :\nhttp://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html\n\nIII. Impact\n~~~~~~~~~~~\nKnown PDF exploits/malware may evade signature detection, 0day exploits\nmay evade heuristics. Disclosure timeline\n~~~~~~~~~~~~~~~~~~~~~~~~~\nDD.MM.YYYY\n01.06.2009 - Reported \n20.10.2009 - McAfee informed us that they published the advisory on their website\n\u003c waiting for others vendors to patch \u003e\n27.10.2009 - G-SEC releases this advisory\n\nAbout G-SEC\n~~~~~~~~~~~\nG-SEC\\x99 is a vendor independent luxemburgish led IT security consulting\ngroup. More information available at : http://www.g-sec.lu/\n\n\n\n\n\n\n\n\n\n\n\n\n_______________________________________________\nFull-Disclosure - We believe in it. ----------------------------------------------------------------------\n\nDo you have VARM strategy implemented?\n\n(Vulnerability Assessment Remediation Management) \n\nIf not, then implement it through the most reliable vulnerability\nintelligence source on the market. \n\nImplement it through Secunia",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-1348"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"db": "BID",
"id": "36848"
},
{
"db": "BID",
"id": "34780"
},
{
"db": "VULHUB",
"id": "VHN-38794"
},
{
"db": "PACKETSTORM",
"id": "77183"
},
{
"db": "PACKETSTORM",
"id": "77170"
},
{
"db": "PACKETSTORM",
"id": "82292"
},
{
"db": "PACKETSTORM",
"id": "82334"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2009-1348",
"trust": 3.1
},
{
"db": "MCAFEE",
"id": "SB10001",
"trust": 2.2
},
{
"db": "BID",
"id": "34780",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "34949",
"trust": 1.9
},
{
"db": "JVNDB",
"id": "JVNDB-2009-004587",
"trust": 0.8
},
{
"db": "BUGTRAQ",
"id": "20090501 [TZO-18-2009] MCAFEE MULTIPLE EVASIONS/BYPASSES (RAR, ZIP)",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200904-560",
"trust": 0.6
},
{
"db": "MCAFEE",
"id": "SB10003",
"trust": 0.5
},
{
"db": "BID",
"id": "36848",
"trust": 0.4
},
{
"db": "SECUNIA",
"id": "37179",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-38794",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "77183",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "77170",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "82292",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "82334",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-38794"
},
{
"db": "BID",
"id": "36848"
},
{
"db": "BID",
"id": "34780"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"db": "PACKETSTORM",
"id": "77183"
},
{
"db": "PACKETSTORM",
"id": "77170"
},
{
"db": "PACKETSTORM",
"id": "82292"
},
{
"db": "PACKETSTORM",
"id": "82334"
},
{
"db": "CNNVD",
"id": "CNNVD-200904-560"
},
{
"db": "NVD",
"id": "CVE-2009-1348"
}
]
},
"id": "VAR-200904-0511",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-38794"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T22:09:03.525000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SB10001",
"trust": 0.8,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10001\u0026actp=LIST_RECENT"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-38794"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"db": "NVD",
"id": "CVE-2009-1348"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.2,
"url": "http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html"
},
{
"trust": 2.1,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=sb10001\u0026actp=list_recent"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/34780"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/34949"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/503173/100/0/threaded"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-1348"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-1348"
},
{
"trust": 0.6,
"url": "http://www.mcafee.com/"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/503173/100/0/threaded"
},
{
"trust": 0.5,
"url": "http://www.g-sec.lu/mcafee-pdf-bypass.html"
},
{
"trust": 0.5,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=sb10003"
},
{
"trust": 0.3,
"url": "/archive/1/503173"
},
{
"trust": 0.2,
"url": "http://www.mcafee.com/apps/downloads/security_updates/dat.asp"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://www.mcafee.com"
},
{
"trust": 0.2,
"url": "http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html"
},
{
"trust": 0.2,
"url": "http://secunia.com/"
},
{
"trust": 0.2,
"url": "http://lists.grok.org.uk/full-disclosure-charter.html"
},
{
"trust": 0.1,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026amp;id=sb10001\u0026amp;actp=list_recent"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/34949/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/try_vi/request_2008_report/"
},
{
"trust": 0.1,
"url": "http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html"
},
{
"trust": 0.1,
"url": "http://www.g-sec.lu/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/37179/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/business_solutions/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-38794"
},
{
"db": "BID",
"id": "36848"
},
{
"db": "BID",
"id": "34780"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"db": "PACKETSTORM",
"id": "77183"
},
{
"db": "PACKETSTORM",
"id": "77170"
},
{
"db": "PACKETSTORM",
"id": "82292"
},
{
"db": "PACKETSTORM",
"id": "82334"
},
{
"db": "CNNVD",
"id": "CNNVD-200904-560"
},
{
"db": "NVD",
"id": "CVE-2009-1348"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-38794"
},
{
"db": "BID",
"id": "36848"
},
{
"db": "BID",
"id": "34780"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"db": "PACKETSTORM",
"id": "77183"
},
{
"db": "PACKETSTORM",
"id": "77170"
},
{
"db": "PACKETSTORM",
"id": "82292"
},
{
"db": "PACKETSTORM",
"id": "82334"
},
{
"db": "CNNVD",
"id": "CNNVD-200904-560"
},
{
"db": "NVD",
"id": "CVE-2009-1348"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2009-04-30T00:00:00",
"db": "VULHUB",
"id": "VHN-38794"
},
{
"date": "2009-10-27T00:00:00",
"db": "BID",
"id": "36848"
},
{
"date": "2009-04-30T00:00:00",
"db": "BID",
"id": "34780"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"date": "2009-05-02T05:21:02",
"db": "PACKETSTORM",
"id": "77183"
},
{
"date": "2009-05-01T02:03:00",
"db": "PACKETSTORM",
"id": "77170"
},
{
"date": "2009-10-28T01:02:31",
"db": "PACKETSTORM",
"id": "82292"
},
{
"date": "2009-10-28T15:59:53",
"db": "PACKETSTORM",
"id": "82334"
},
{
"date": "2009-04-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200904-560"
},
{
"date": "2009-04-30T20:30:00.467000",
"db": "NVD",
"id": "CVE-2009-1348"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-10T00:00:00",
"db": "VULHUB",
"id": "VHN-38794"
},
{
"date": "2015-03-19T09:04:00",
"db": "BID",
"id": "36848"
},
{
"date": "2009-05-01T22:46:00",
"db": "BID",
"id": "34780"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"date": "2009-05-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200904-560"
},
{
"date": "2024-11-21T01:02:15.190000",
"db": "NVD",
"id": "CVE-2009-1348"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "36848"
},
{
"db": "BID",
"id": "34780"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "McAfee VirusScan Used in products such as AV Vulnerabilities that can be avoided in the engine",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200904-560"
}
],
"trust": 0.6
}
}
CVE-2016-8030 (GCVE-0-2016-8030)
Vulnerability from cvelistv5
Published
2017-04-25 16:00
Modified
2024-08-06 02:13
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- A memory corruption vulnerability
Summary
A memory corruption vulnerability in Scriptscan COM Object in McAfee VirusScan Enterprise 8.8 Patch 8 and earlier allows remote attackers to create a Denial of Service on the active Internet Explorer tab via a crafted HTML link.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/98041 | vdb-entry, x_refsource_BID | |
| https://kc.mcafee.com/corporate/index?page=content&id=SB10194 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| McAfee | VirusScan Enterprise |
Version: 8.8 Patch 8 and earlier |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:13:21.817Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "98041",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/98041"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10194"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "VirusScan Enterprise",
"vendor": "McAfee",
"versions": [
{
"status": "affected",
"version": "8.8 Patch 8 and earlier"
}
]
}
],
"datePublic": "2017-04-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A memory corruption vulnerability in Scriptscan COM Object in McAfee VirusScan Enterprise 8.8 Patch 8 and earlier allows remote attackers to create a Denial of Service on the active Internet Explorer tab via a crafted HTML link."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A memory corruption vulnerability",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-04-28T09:57:01",
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel"
},
"references": [
{
"name": "98041",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/98041"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10194"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secure@intel.com",
"ID": "CVE-2016-8030",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "VirusScan Enterprise",
"version": {
"version_data": [
{
"version_value": "8.8 Patch 8 and earlier"
}
]
}
}
]
},
"vendor_name": "McAfee"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A memory corruption vulnerability in Scriptscan COM Object in McAfee VirusScan Enterprise 8.8 Patch 8 and earlier allows remote attackers to create a Denial of Service on the active Internet Explorer tab via a crafted HTML link."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "A memory corruption vulnerability"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "98041",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/98041"
},
{
"name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10194",
"refsource": "CONFIRM",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10194"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"assignerShortName": "intel",
"cveId": "CVE-2016-8030",
"datePublished": "2017-04-25T16:00:00",
"dateReserved": "2016-09-09T00:00:00",
"dateUpdated": "2024-08-06T02:13:21.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}