CVE-2018-6668 : Security Advisory and Response
Learn about CVE-2018-6668, a whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and earlier versions, allowing security restrictions to be evaded by executing a simple DLL.
A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and earlier versions allows the execution bypass, enabling security restrictions to be evaded by executing a simple DLL through interpreters like PowerShell.
Understanding CVE-2018-6668
This CVE involves a vulnerability in McAfee Application Control / Change Control 7.0.1 and earlier versions, known as a whitelist bypass, which can lead to security restrictions being bypassed.
What is CVE-2018-6668?
CVE-2018-6668 is an execution bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and earlier versions, allowing the bypass of security restrictions by executing a simple DLL through interpreters like PowerShell.
The Impact of CVE-2018-6668
The impact of this vulnerability is rated as MEDIUM severity with a CVSS base score of 6.1. The attack complexity is LOW, requiring low privileges and no user interaction, but with a high availability impact.
Technical Details of CVE-2018-6668
This section provides more technical insights into the CVE.
Vulnerability Description
The vulnerability allows for a whitelist bypass in McAfee Application Control / Change Control 7.0.1 and earlier versions, enabling the execution bypass through interpreters like PowerShell.
Affected Systems and Versions
- Platforms: x86
- Product: McAfee Application and Change Control
- Vendor: McAfee
- Versions Affected: 7.0.1 and earlier
Exploitation Mechanism
The bypass of security restrictions can be achieved by executing a simple DLL through interpreters like PowerShell.
Mitigation and Prevention
To address CVE-2018-6668, follow these mitigation steps:
Immediate Steps to Take
- Install or update to McAfee Application and Change Control (MACC) Application 8.0.0 and MACC ePO extension 8.0.0 or later.
Long-Term Security Practices
- Regularly update security software and patches.
- Implement least privilege access controls.
- Monitor and restrict the use of interpreters like PowerShell.
Patching and Updates
Ensure that McAfee Application and Change Control (MACC) Application and MACC ePO extension are kept up to date to prevent exploitation of this vulnerability.