CVE-2002-2282: Medium severity McAfee VirusScan vulnerability
McAfee VirusScan 4.5.1, when the WebScanX.exe module is enabled, searches for particular DLLs from the user's home directory, even when browsing the local hard drive, which allows local users to run arbitrary code via malicious versions of those DLLs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the WebScanX.exe module in McAfee VirusScan to prevent it from loading/searching for DLLs from users' home directories.
McAfee VirusScan WebScanX (WebScanX.exe) enabled = false - Operational
Identify systems running McAfee VirusScan 4.5.1 and determine whether WebScanX.exe is enabled. For systems with WebScanX.exe enabled, disable the module and scan users' home directories for unexpected or malicious DLL files (remove or quarantine discovered malicious DLLs) and investigate hosts for signs of code execution or compromise.
Event History
Frequently Asked Questions
What is the severity of CVE-2002-2282?
CVE-2002-2282 is categorized as a high severity vulnerability due to its potential for arbitrary code execution by local users.
How do I fix CVE-2002-2282?
To fix CVE-2002-2282, it is recommended to upgrade to a newer version of McAfee VirusScan that does not contain this vulnerability.
Who is affected by CVE-2002-2282?
Users of McAfee VirusScan version 4.5.1 are primarily affected by CVE-2002-2282.
What type of attacks can exploit CVE-2002-2282?
CVE-2002-2282 can be exploited through the execution of malicious DLL files placed in the user's home directory.
When was CVE-2002-2282 disclosed?
CVE-2002-2282 was disclosed in December 2002.