CVE-2018-6690— McAfee Application Control (MAC) - Whitelist bypass using a hard drive solidified by MACC
Quick assessment
Affected
McAfee McAfee Application Control (MAC)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
McAfee Application and Change Control（MACC）是美国迈克菲（McAfee）公司的一套程序管控软件。该软件通过使用动态的信任模型，保护企业的服务器和终端免受未经授权应用程序和恶意软件的威胁。Microsoft Windows client是它的一个基于Windows平台的客户端。 McAfee MACC 8.0.0 Hotfix 4及之前版本中的Microsoft Windows客户端存在安全漏洞。攻击者可通过从外部系统传输文件利用该漏洞执行任意代码。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2018-6690
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
McAfee Application Control (MAC) - Whitelist bypass using a hard drive solidified by MACC
Source: CVE Program / CVE List V5
Vulnerability Description
Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
McAfee Application and Change Control Microsoft Windows客户端存安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
McAfee Application and Change Control（MACC）是美国迈克菲（McAfee）公司的一套程序管控软件。该软件通过使用动态的信任模型，保护企业的服务器和终端免受未经授权应用程序和恶意软件的威胁。Microsoft Windows client是它的一个基于Windows平台的客户端。 McAfee MACC 8.0.0 Hotfix 4及之前版本中的Microsoft Windows客户端存在安全漏洞。攻击者可通过从外部系统传输文件利用该漏洞执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| McAfee | McAfee Application Control (MAC) | 8.0.0 HF 4 ~ 8.0.0 HF 4 | - |
|
II. Public POCs for CVE-2018-6690
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-6690
请登录查看更多情报信息。
Other References for CVE-2018-6690 (1)
-
https://kc.mcafee.com/corporate/index?page=content&id=SB10250 x_refsource_CONFIRM
Same Patch Batch · McAfee · 2018-09-18 · 3 CVEs total
| CVE-2017-3912 | McAfee Application Control and Change Control (MACC) - password management security featur | |
| CVE-2018-6693 | Endpoint Security for Linux Threat Prevention (ENSLTP) privilege escalation vulnerability |
IV. Related Vulnerabilities
Same vendor: McAfee
-
CVE-2022-0280
McAfee Total Protection (MTP) - File Deletion vulnerability -
CVE-2022-0815
McAfee WebAdvisor - Extension Fingerprinting vulnerability -
CVE-2021-31848
Data Loss Prevention (DLP) ePO extension - Cross site script -
CVE-2021-31849
Data Loss Prevention (DLP) ePO extension - SQL injection -
CVE-2021-23877
McAfee Total Protection (MTP) - Privilege Escalation vulnera
V. Comments for CVE-2018-6690
No comments yet