Privacy Ninja

McAfee Agent Bug Lets Hackers Run Code with Windows SYSTEM Privileges

McAfee Agent Bug Lets Hackers Run Code with Windows SYSTEM Privileges

McAfee Enterprise (now rebranded as Trellix) has patched a security vulnerability discovered in the company’s McAfee Agent software for Windows enabling attackers to escalate privileges and execute arbitrary code with SYSTEM privileges.

McAfee Agent is a client-side component of McAfee ePolicy Orchestrator (McAfee ePO) that downloads and enforces endpoint policies and deploys antivirus signatures, upgrades, patches, and new products on enterprise endpoints.

Also Read: The Top 4W’s of Ethical Hacking

The company has fixed the high severity local privilege escalation (LPE) flaw tracked as CVE-2022-0166 and discovered by CERT/CC vulnerability analyst Will Dormann issued security updates with the release of McAfee Agent 5.7.5 on January 18.

All McAfee Agent versions before 5.7.5 are vulnerable and allow unprivileged attackers to run code using NT AUTHORITY\SYSTEM account privileges, the highest level of privileges on a Windows system, used by the OS and OS services.

“McAfee Agent, which comes with various McAfee products such as McAfee Endpoint Security, includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory that my be controllable by an unprivileged user on Windows,” Dormann explained.

“McAfee Agent contains a privileged service that uses this OpenSSL component. A user who can place a specially-crafted openssl.cnf file at an appropriate path may be able to achieve arbitrary code execution with SYSTEM privileges.”

Exploitable for evasion, loading malicious payloads

Following successful exploitation, threat actors could persistently execute malicious payloads and potentially evade detection during attacks.

While only exploitable locally, threat actors commonly exploit this type of security flaw during later stages of their attacks, after infiltrating the target machine to elevate permissions for gaining persistence and further compromising the system.

Also Read: What is Social Engineering and How Does it Work?

This is not the first time security researchers have found vulnerabilities while analyzing McAfee’s Windows security products.

For instance, in September 2021, the company patched another McAfee Agent privilege escalation bug (CVE-2020-7315) discovered by Tenable security researcher Clément Notin that allowed local users to execute arbitrary code and kill the antivirus.

Two years before, McAfee fixed a security vulnerability impacting all editions of its Antivirus software for Windows (i.e., Total Protection, Anti-Virus Plus, and Internet Security) and allowing potential attackers to escalate privileges and execute code with SYSTEM account authority.

Outsourced DPO – It is mandatory to appoint a Data Protection Officer. Engage us today.

PDPA Training (SkillsFuture Eligible) – Empower data protection knowledge for your employees.

Vulnerability Assessment Penetration Testing – Find loopholes in your websites, mobile apps or systems.

0 Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Powered by WhatsApp Chat

× Chat with us on WhatsApp