{"uuid": "034acc73-17df-4d3f-993e-242385a99beb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31854", "type": "seen", "source": "https://t.me/hacking_Attack/39938", "content": "Black Hat Ethical Hacking\nMcAfee Bug Can Be Exploited to Gain Windows SYSTEM Privileges\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png McAfee Bug Can Be Exploited to Gain Windows SYSTEM PrivilegesPost Views: 187 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nMcAfee has patched two high-severity bugs in its Agent component, one of which can allow attackers to achieve arbitrary code execution with SYSTEM privileges.\nMcAfee has patched two high-severity vulnerabilities in a component of its McAfee Enterprise product that attackers can use to escalate privileges, including up to SYSTEM.\n\nAccording to McAfee\u2019s bulletin, the bugs are in versions prior to 5.7.5 of McAfee Agent,\u00a0which is used in McAfee Endpoint Security, among other McAfee products.\n\nThe Agent is the piece of McAfee ePolicy Orchestrator (McAfee ePO) that downloads and enforces policies and executes client-side tasks such as deployment and updating.\n\nThe McAfee Agent is also the component that uploads events and provides additional data regarding each system\u2019s status. Periodically collecting and sending event information to the McAfee ePO server, the Agent \u2013 which also installs and updates endpoint products \u2013 is a required install on any network system that needs to be managed.\nSee Also: Complete Offensive Security and Ethical Hacking Course OpenSSL Component Bug Can Lead to SYSTEM PrivilegesOne of the flaws in the Agent \u2013 tracked as CVE-2022-0166 and given a CVSS base criticality rating of 7.8 \u2013 was discovered by Will Dormann of the Carnegie Mellon University\u2019s CERT Coordination Center (CERT/CC).\n\nOn Thursday, CERT/CC published an advisory\u00a0that said that the vulnerability is found in an OpenSSL component in Agent that specifies an OPENSSLDIR variable as a subdirectory that \u201c[may] be controllable by an unprivileged user on Windows.\u201d\n\nAccording to the advisory, McAfee Agent \u201ccontains a privileged service that uses this OpenSSL component. A user who can place a specially crafted openssl.cnf file at an appropriate path may be able to achieve arbitrary code execution with SYSTEM privileges.\u201d\n\nDormann found that an unprivileged user could exploit the bug to place a specially crafted openssl.cnf in a location used by McAfee Agent and thus potentially be able to execute arbitrary code with SYSTEM privileges on a Windows system that has the vulnerable McAfee Agent software installed.\n\nWhen Dormann referred to an openssl.cnf, he was talking about an OpenSSL configuration file: a file that provides SSL defaults for items such as certificate files locations, and site details such as those entered during installation.\nSee Also: Microsoft: New critical Windows HTTP vulnerability is wormable Arbitrary Shell CodeThe second bug in the Agent \u2013 tracked as CVE-2021-31854 and given a CVSS criticality rating of 7.7 \u2013 can be exploited by a local user to inject arbitrary shell code into a file, McAfee said in its advisory. \u201cAn attacker can exploit the security hole to obtain a reverse shell that allows them to gain root privileges,\u201d according to the company.\n\nThe vulnerability, which is still pending analysis by its discoverer \u2013 Russell Wells from Cyberlinx Security \u2013 is a command-injection vulnerability in McAfee Agent for Windows prior to 5.7.5. McAfee said that it allows local users to inject arbitrary shell code into the file cleanup.exe.\n\n\u201cThe malicious clean.exe file is placed into the relevant folder and executed by running the McAfee Agent deployment feature located in the System Tree,\u201d according to McAfee. \u201cAn attacker may exploit the vulnerability to obtain [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:21.482097Z"}