cnvd - cnvd-2021-39932

CNVD-2021-39932

Vulnerability from cnvd - Published: 2021-06-07

Title

Mcafee Data Loss Prevention Endpoint存在未明漏洞

Description

Mcafee Data Loss Prevention Endpoint（DLPe）是美国迈克菲（Mcafee）公司的一套集成式终端数据保护解决方案。该方案能够防止机密数据被盗和意外泄露，并提供针对文件处理和传输的安全策略、共享终端数据流控制和数据加密等功能。 McAfee Data Loss Prevention Endpoint 存在安全漏洞，攻击者可利用该漏洞写入任意受控制的内核地址。

Severity

高

Patch Name

Mcafee Data Loss Prevention Endpoint存在未明漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://kc.mcafee.com/corporate/index?page=content&id=SB10357

Reference

https://kc.mcafee.com/corporate/index?page=content&id=SB10354

Impacted products

Name
McAfee McAfee Data Loss Prevention for Windows <11.6.100

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-23887",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-23887"
    }
  },
  "description": "Mcafee Data Loss Prevention Endpoint\uff08DLPe\uff09\u662f\u7f8e\u56fd\u8fc8\u514b\u83f2\uff08Mcafee\uff09\u516c\u53f8\u7684\u4e00\u5957\u96c6\u6210\u5f0f\u7ec8\u7aef\u6570\u636e\u4fdd\u62a4\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u80fd\u591f\u9632\u6b62\u673a\u5bc6\u6570\u636e\u88ab\u76d7\u548c\u610f\u5916\u6cc4\u9732\uff0c\u5e76\u63d0\u4f9b\u9488\u5bf9\u6587\u4ef6\u5904\u7406\u548c\u4f20\u8f93\u7684\u5b89\u5168\u7b56\u7565\u3001\u5171\u4eab\u7ec8\u7aef\u6570\u636e\u6d41\u63a7\u5236\u548c\u6570\u636e\u52a0\u5bc6\u7b49\u529f\u80fd\u3002\n\nMcAfee Data Loss Prevention  Endpoint \u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5199\u5165\u4efb\u610f\u53d7\u63a7\u5236\u7684\u5185\u6838\u5730\u5740\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://kc.mcafee.com/corporate/index?page=content\u0026id=SB10357",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-39932",
  "openTime": "2021-06-07",
  "patchDescription": "Mcafee Data Loss Prevention Endpoint\uff08DLPe\uff09\u662f\u7f8e\u56fd\u8fc8\u514b\u83f2\uff08Mcafee\uff09\u516c\u53f8\u7684\u4e00\u5957\u96c6\u6210\u5f0f\u7ec8\u7aef\u6570\u636e\u4fdd\u62a4\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u80fd\u591f\u9632\u6b62\u673a\u5bc6\u6570\u636e\u88ab\u76d7\u548c\u610f\u5916\u6cc4\u9732\uff0c\u5e76\u63d0\u4f9b\u9488\u5bf9\u6587\u4ef6\u5904\u7406\u548c\u4f20\u8f93\u7684\u5b89\u5168\u7b56\u7565\u3001\u5171\u4eab\u7ec8\u7aef\u6570\u636e\u6d41\u63a7\u5236\u548c\u6570\u636e\u52a0\u5bc6\u7b49\u529f\u80fd\u3002\r\n\r\nMcAfee Data Loss Prevention  Endpoint \u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5199\u5165\u4efb\u610f\u53d7\u63a7\u5236\u7684\u5185\u6838\u5730\u5740\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Mcafee Data Loss Prevention Endpoint\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "McAfee McAfee Data Loss Prevention for Windows \u003c11.6.100"
  },
  "referenceLink": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10354",
  "serverity": "\u9ad8",
  "submitTime": "2021-05-08",
  "title": "Mcafee Data Loss Prevention Endpoint\u5b58\u5728\u672a\u660e\u6f0f\u6d1e"
}

CVE-2021-23887 (GCVE-0-2021-23887)

Vulnerability from cvelistv5 – Published: 2021-04-15 07:55 – Updated: 2024-08-03 19:14

Title

Privilege escalation in McAfee DLP Endpoint for Windows

Summary

Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to write to arbitrary controlled kernel addresses. This is achieved by launching applications, suspending them, modifying the memory and restarting them when they are monitored by McAfee DLP through the hdlphook driver.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-269 - Privilege escalation vulnerability

Assigner

trellix

References

URL

Tags

	https://kc.mcafee.com/corporate/index?page=conten…	x_refsource_CONFIRM
	https://kc.mcafee.com/corporate/index?page=conten…	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	McAfee,LLC	McAfee Data Loss Prevention (DLP) Endpoint for Windows	Affected: unspecified , < 10.6.100.41 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:14:09.191Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10354"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10357"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "McAfee Data Loss Prevention (DLP) Endpoint for Windows",
          "vendor": "McAfee,LLC",
          "versions": [
            {
              "lessThan": "10.6.100.41",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to write to arbitrary controlled kernel addresses. This is achieved by launching applications, suspending them, modifying the memory and restarting them when they are monitored by McAfee DLP through the hdlphook driver."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Privilege escalation vulnerability  ",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-15T08:06:20",
        "orgId": "01626437-bf8f-4d1c-912a-893b5eb04808",
        "shortName": "trellix"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10354"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10357"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Privilege escalation in McAfee DLP Endpoint for Windows",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@mcafee.com",
          "ID": "CVE-2021-23887",
          "STATE": "PUBLIC",
          "TITLE": "Privilege escalation in McAfee DLP Endpoint for Windows"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "McAfee Data Loss Prevention (DLP) Endpoint for Windows",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "10.6.100.41"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "McAfee,LLC"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to write to arbitrary controlled kernel addresses. This is achieved by launching applications, suspending them, modifying the memory and restarting them when they are monitored by McAfee DLP through the hdlphook driver."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-269: Privilege escalation vulnerability  "
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10354",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10354"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10357",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10357"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "01626437-bf8f-4d1c-912a-893b5eb04808",
    "assignerShortName": "trellix",
    "cveId": "CVE-2021-23887",
    "datePublished": "2021-04-15T07:55:15",
    "dateReserved": "2021-01-12T00:00:00",
    "dateUpdated": "2024-08-03T19:14:09.191Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-39932

CVE-2021-23887 (GCVE-0-2021-23887)

Tags

Sightings

Nomenclature