Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-8021

CWE-3474 documents4 sources

Severity

5.0MEDIUM

EPSS

2.8%

top 13.78%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Mcafee Virusscan Enterprise Intel Virusscan Enterprise Linux (vsel)

Timeline

PublishedMar 14

Latest updateMay 17

Description

Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to spoof update server and execute arbitrary code via a crafted input file.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:NExploitability: 1.3 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5intel/virusscan_enterprise_linux_(vsel)2.0.3 (and earlier)

▶NVDmcafee/virusscan_enterprise2.0.3

🔴Vulnerability Details

GHSA

GHSA-8vrh-6fx9-v2mh: Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2↗2022-05-17

▶

CVEList

CVE-2016-8021: Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2↗2017-03-14

▶

💥Exploits & PoCs

Exploit-DB

McAfee Virus Scan Enterprise for Linux 1.9.2 < 2.0.2 - Remote Code Execution↗2016-12-13

▶