CVE-2005-3657

The ActiveX control in MCINSCTL.DLL for McAfee VirusScan Security Center does not use the IObjectSafetySiteLock API to restrict access to required domains, which allows remote attackers to create or append to arbitrary files via the StartLog and AddLog methods in the MCINSTALL.McLog object.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/18169
http://securityreason.com/securityalert/279
http://securitytracker.com/id?1015390
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=358	Vendor Advisory
http://www.securityfocus.com/bid/15986
http://www.vupen.com/english/advisories/2005/3006

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mcafee:mcinsctl.dll:4.0.0.83:::::::*
	cpe:2.3:a:mcafee:virusscan_security_center::::::::
	cpe:2.3:a:mcafee:virusscan_security_center:4.0:::::::*
	cpe:2.3:a:mcafee:virusscan_security_center:4.0.3:::::::*
	cpe:2.3:a:mcafee:virusscan_security_center:4.5:::::::*
	cpe:2.3:a:mcafee:virusscan_security_center:4.5.1:::::::*
	cpe:2.3:a:mcafee:virusscan_security_center:5.0:::::::*
	cpe:2.3:a:mcafee:virusscan_security_center:6.0:::::::*
	cpe:2.3:a:mcafee:virusscan_security_center:7.0:::::::*
	cpe:2.3:a:mcafee:virusscan_security_center:7.1:::::::*
	cpe:2.3:a:mcafee:virusscan_security_center:8.0:::::::*
	cpe:2.3:a:mcafee:virusscan_security_center:9.0:::::::*

History

No history.

Information

Published : 2005-12-21 11:03

Updated : 2011-03-08 02:26

NVD link : CVE-2005-3657

Mitre link : CVE-2005-3657

CVE.ORG link : CVE-2005-3657

JSON object : View

Products Affected

mcafee

virusscan_security_center
mcinsctl.dll

CWE

NVD-CWE-Other

{"id": "CVE-2005-3657", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2005-12-21T11:03:00.000", "references": [{"url": "http://secunia.com/advisories/18169", "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/279", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1015390", "source": "cve@mitre.org"}, {"url": "http://www.idefense.com/intelligence/vulnerabilities/display.php?id=358", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/15986", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2005/3006", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The ActiveX control in MCINSCTL.DLL for McAfee VirusScan Security Center does not use the IObjectSafetySiteLock API to restrict access to required domains, which allows remote attackers to create or append to arbitrary files via the StartLog and AddLog methods in the MCINSTALL.McLog object."}], "lastModified": "2011-03-08T02:26:56.377", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mcafee:mcinsctl.dll:4.0.0.83:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78B45B1F-5624-4B1E-8C7F-24F05437C521"}, {"criteria": "cpe:2.3:a:mcafee:virusscan_security_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84FABAFF-9E4D-4093-83AB-A68D31FC8673"}, {"criteria": "cpe:2.3:a:mcafee:virusscan_security_center:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1A41649-7CA4-456C-9D26-AF8CA7AC1737"}, {"criteria": "cpe:2.3:a:mcafee:virusscan_security_center:4.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3C5AF02-737D-45B6-9287-840E901AB9C3"}, {"criteria": "cpe:2.3:a:mcafee:virusscan_security_center:4.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8CC42959-5772-4500-AB00-0FD4DE4C367B"}, {"criteria": "cpe:2.3:a:mcafee:virusscan_security_center:4.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D14412B8-3A19-4888-9402-875B15BB688C"}, {"criteria": "cpe:2.3:a:mcafee:virusscan_security_center:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18233BDF-9E72-4C77-93F8-53D61254FB4B"}, {"criteria": "cpe:2.3:a:mcafee:virusscan_security_center:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEEDCBC0-9F8E-42E1-9410-1FD285E6BF11"}, {"criteria": "cpe:2.3:a:mcafee:virusscan_security_center:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D8195D6-F9D1-467A-BEDB-770C1179AB53"}, {"criteria": "cpe:2.3:a:mcafee:virusscan_security_center:7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E121CCD-A765-450A-B313-75A0C1FB4CE6"}, {"criteria": "cpe:2.3:a:mcafee:virusscan_security_center:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "20EEEC53-E69C-4B17-B9AD-9DA7840761BE"}, {"criteria": "cpe:2.3:a:mcafee:virusscan_security_center:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CAE82552-B631-4AB3-9A06-7267CF32042E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

5.0 /10