McAfee VirusScan Enterprise Insecure Library Loading Vulnerability

Last Update Date: 28 Jan 2011 Release Date: 30 Nov 2010 5740 Views

RISK: Medium Risk

A vulnerability has been identified in McAfee VirusScan Enterprise, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to the application loading libraries (e.g. traceapp.dll) in an insecure manner. This can be exploited to load arbitrary libraries by tricking a user into e.g. opening a Word Document with an embedded ActiveX control located on a remote WebDAV or SMB share in Microsoft Office 2003.

Impact

Remote Code Execution

System / Technologies affected

McAfee VirusScan Enterprise version 8.5.0i (patch 8, 32bit scanmodule version 5400.1158, DAT version 6107.0000)
Note: Other versions may also be affected.

Solutions

It is not aware of any vendor-supplied patch.

Vulnerability Identifier

No CVE information is available

Source

Secunia