Medium severity · published Apr 8, 2016
CVE-2016-3984
The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL)…
5.1
CVSS
1.1%
EPSS
No
On KEV
Description
The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL) before 2.0.1.140.1, Data Loss Prevention Endpoint (DLPe) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Device Control (MDC) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Endpoint Security (ENS) 10.x before 10.1, Host Intrusion Prevention Service (IPS) 8.0 before 8.0.0.3624, and VirusScan Enterprise (VSE) 8.8 before P7 (8.8.0.1528) on Windows allows local administrators to bypass intended self-protection rules and disable the antivirus engine by modifying registry keys.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Active Response · Mcafee
through 1.1.0.158 · source: NVD
AG
Agent · Mcafee
through 5.0.2.285 · source: NVD
DE
Data Exchange Layer · Mcafee
through 2.0.0.430.1 · source: NVD
DL
Data Loss Prevention Endpoint · Mcafee
through 9.3.0; through 9.4.0 · source: NVD
ES
Endpoint Security · Mcafee
through 10.0.1 · source: NVD
HI
Host Intrusion Prevention · Mcafee
through 8.0.0 · source: NVD
VE
Virusscan Enterprise · Mcafee
through 8.8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-3984
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-3984
Exploit
http://lab.mediaservice.net/advisory/2016-01-mcafee.txt
seclists.org
http://seclists.org/fulldisclosure/2016/Mar/13
www.securitytracker.com
http://www.securitytracker.com/id/1035130
Vendor Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10151
Exploit
https://www.exploit-db.com/exploits/39531/
More from Active Response
7.8
CVE-2020-7291
Privilege Escalation vulnerability in McAfee Active Response (MAR) for Mac prior to 2.4.3 Hotfix 1 allows a malicious script or program to perform functions that the local…
7.8
CVE-2020-7290
Privilege Escalation vulnerability in McAfee Active Response (MAR) for Linux prior to 2.4.3 Hotfix 1 allows a malicious script or program to perform functions that the local…
7.8
CVE-2020-7289
Privilege Escalation vulnerability in McAfee Active Response (MAR) for Windows prior to 2.4.3 Hotfix 1 allows a malicious script or program to perform functions that the local…
7.5
CVE-2019-3644
McAfee Web Gateway (MWG) earlier than 7.8.2.13 is vulnerable to a remote attacker exploiting CVE-2019-9517, potentially leading to a denial of service
7.5
CVE-2019-3643
McAfee Web Gateway (MWG) earlier than 7.8.2.13 is vulnerable to a remote attacker exploiting CVE-2019-9511, potentially leading to a denial of service