CVE-2016-3984

published 2016-04-08

CVE-2016-3984: The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data…

Priority P4 25 medium 5.1 CVSS 3.0

AV L AC L PR H UI N S U C N I L A H

EXPLOIT

The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL) before 2.0.1.140.1, Data Loss Prevention Endpoint (DLPe) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Device Control (MDC) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Endpoint Security (ENS) 10.x before 10.1, Host Intrusion Prevention Service (IPS) 8.0 before 8.0.0.3624, and VirusScan Enterprise (VSE) 8.8 before P7 (8.8.0.1528) on Windows allows local administrators to bypass intended self-protection rules and disable the antivirus engine by modifying registry keys.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
mcafee	active_response	<= 1.1.0.158	—
mcafee	agent	<= 5.0.2.285	—
mcafee	data_exchange_layer	<= 2.0.0.430.1	—
mcafee	data_loss_prevention_endpoint	<= 9.3.0	—
mcafee	data_loss_prevention_endpoint	<= 9.4.0	—
mcafee	endpoint_security	<= 10.0.1	—
mcafee	host_intrusion_prevention	<= 8.0.0	—
mcafee	virusscan_enterprise	<= 8.8.0	—

CVSS provenance

nvd v3.0 5.1 MEDIUM CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

nvd v2.0 3.6 LOW AV:L/AC:L/Au:N/C:N/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-284