|
|
>> McAfee Internet Security Suite 2005 Insecure File Permission
|
Title : McAfee Internet Security Suite 2005 Insecure File Permission
VUPEN ID : VUPEN/ADV-2005-0362
CVE ID : CVE-2005-1107
CWE ID : CWE-
Rated as : Low Risk 
Remotely Exploitable : No
Locally Exploitable : Yes
Release Date : 2005-04-19
|
A new vulnerability was identified in McAfee Internet Security Suite, which could be exploited by local attackers to bypass certain security restrictions. The flaw resides in the default file Access Control List (ACL) settings that are applied during installation. The default ACL allows non-Administrator users to modify the installed files, which may be exploited by a malicious user to replace an installed McAfee Internet Security Suite 2005 file with a malicious code that will later be executed with system privileges.
Affected Products
McAfee Internet Security Suite 2005
Solution
McAfee has acknowledged this issue and is providing automated fixes for registered users.
References
http://www.vupen.com/english/advisories/2005/0362
http://www.idefense.com/application/poi/display?id=233&type=vulnerabilities
Credits
Vulnerability reported by iDEFENSE
ChangeLog
2005-04-19 : Initial release
Vulnerability Management
Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form. | |
|
