McAfee is urging users to upgrade older versions of its VirusScan Enterprise product for Linux because its suffers from10 vulnerabilities, a researcher said.
The end result of the vulnerabilities is they could end up chained together which could allow for remote code execution with root privileges, said researcher Andrew Fasano.
The vulnerabilities went out to Intel Security’s McAfee via CERT/CC in June, but users only learned about the availability of patches late last week, Fasano said in a blog post.
Intel Security officials said the vulnerabilities affect VirusScan Enterprise for Linux (VSEL) 2.0.3 and earlier. Since the VSEL product will soon reach end of life, the vendor suggested users upgrade to Endpoint Security for Linux (ENSL) 10.2 or later, which addresses the flaws. CERT/CC said existing customers can upgrade free of charge.
There are quite a few vulnerabilities in the product, including information disclosure, special element injection, cross-site request forgery (CSRF), cross-site scripting (XSS), remote code execution, privilege escalation, authentication brute-force, SQL injection, and arbitrary file write issues, Fasano said.
Intel Security has classified four of the flaws as having high severity, while the rest have been rated medium severity.
Four of the security holes can end up chained to achieve remote code execution with root privileges, Fasano said.
The attack starts with a flaw that allows the remote use of authentication tokens (CVE-2016-8022) that have been brute-forced (CVE-2016-8023). The attacker then deploys a malicious update server and leverages CVE-2016-8022 to configure the product to use that server.
An arbitrary file write vulnerability (CVE-2016-8021) can then end up exploited to create a malicious script obtained from the update server. This flaw can also combine with a privilege escalation (CVE-2016-8020) that enables the attacker to obtain root permissions.
The attacker can execute the malicious script as root on the system. The researcher published proof-of-concept (PoC) code for this exploit chain.