Tuesday, March 5, 2024

Vulnerability in McAfee Antivirus Software Let Hackers Execute an Arbitrary Code & Escalates System Privilege

McAfee patched a Privilege Escalation vulnerability in Microsoft Windows client versions of all McAfee Antivirus versions that allow administrators to execute arbitrary code and escalate to SYSTEM privileges.

The system account is the internal account used by the Windows operating system to manage the services that run under Windows.

The vulnerability affects Microsoft Windows client in McAfee Total Protection, McAfee Anti-Virus Plus, and McAfee Internet Security, 16.0.R22 and earlier.

Escalation Vulnerability Discovery

The vulnerability was discovered by SafeBreach Labs in all the editions of McAfee Antivirus software. To exploit this vulnerability the attacker needs to be a system administrator.

“This vulnerability could be used by an attacker to bypass McAfee’s Self-Defense mechanism, evade defense and achieve persistence by loading multiple services that run as NT AUTHORITY\SYSTEM.”

McAfee Antivirus
Trying to load from System32\Wbem

With the Anti-virus software, multiple parts run as a Windows service executed by “NT AUTHORITY\SYSTEM,” which has SYSTEM permission.

Researchers found that McAfee Antivirus software which runs as a signed process and as NT AUTHORITY\SYSTEM tries to load the wbemcomn.dll file from location (c:\Windows\System32\wbem\wbemcomn.dll) whereas the file present under System32 and not with System32\Wbem folder.

This allows researchers to load an unsigned arbitrary DLL to load in the process and to bypass the self-defense mechanism of the Antivirus software. “This is mainly because the folders of the McAfee software are protected by a mini-filter filesystem driver, which restricts writing operations even by an Administrator.”

The vulnerability gives attackers an ability to load and execute malicious payloads using multiple signed services in a persistent way within the context of McAfee’s signed processes.

The vulnerability can be tracked as CVE-2019-3648 and it was reported to McAfee on Aug 5th, 2019, it has been patched now and McAfee urges users to update with 16.0.R22 Refresh 1 version that fixes the privilege escalation vulnerability.

This is not the first time like McAfee Hadar reported privilege escalation vulnerability in other security vendors such as Avast Antivirus, AVG Antivirus, Trend Micro and Check Point Endpoint security.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates

Website

Latest articles

US Court Orders NSO Group to Handover Code for Spyware, Pegasus to WhatsApp

Meta, the company that owns WhatsApp, filed a lawsuit against NSO Group in 2019....

New SSO-Based Phishing Attack Trick Users into Sharing Login Credentials  

Threat actors employ phishing scams to trick individuals into giving away important details like...

U.S. Charged Iranian Hacker, Rewards up to $10 Million

The United States Department of Justice (DoJ) has charged an Iranian national, Alireza Shafie...

Huge Surge in Ransomware-as-a-Service Attacks targeting Middle East & Africa

The Middle East and Africa (MEA) region has witnessed a surge in ransomware-as-a-service (RaaS)...

New Silver SAML Attack Let Attackers Forge Any SAML Response To Entra ID

SolarWinds cyberattack was one of the largest attacks of the century in which attackers...

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles