CVE-2022-0166

 

Published at: - 19-01-2022 12:15

Last modified: - 25-01-2022 09:12

Total changes: - 3

Description

A privilege escalation vulnerability in the McAfee Agent prior to 5.7.5. McAfee Agent uses openssl.cnf during the build process to specify the OPENSSLDIR variable as a subdirectory within the installation directory. A low privilege user could have created subdirectories and executed arbitrary code with SYSTEM privileges by creating the appropriate pathway to the specifically created malicious openssl.cnf file.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://kc.mcafee.com/corporate/index?page=content&id=SB10378
• VU#287178-Third Party Advisory, US Government Resource

 

Keywords

NVD

 

CVE-2022-0166

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures