CVE-2016-3984: Medium severity mcafee active response vulnerability
The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL) before 2.0.1.140.1, Data Loss Prevention Endpoint (DLPe) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Device Control (MDC) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Endpoint Security (ENS) 10.x before 10.1, Host Intrusion Prevention Service (IPS) 8.0 before 8.0.0.3624, and VirusScan Enterprise (VSE) 8.8 before P7 (8.8.0.1528) on Windows allows local administrators to bypass intended self-protection rules and disable the antivirus engine by modifying registry keys.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3984?
CVE-2016-3984 has a medium severity rating and could allow an attacker to perform unauthorized actions.
How do I fix CVE-2016-3984?
To fix CVE-2016-3984, update McAfee Active Response to version 1.1.0.161 or later, or apply the necessary patches for the affected software versions.
What products are affected by CVE-2016-3984?
CVE-2016-3984 affects several McAfee products including Active Response, Agent, Data Exchange Layer, Data Loss Prevention Endpoint, Endpoint Security, Host Intrusion Prevention, and VirusScan Enterprise.
What are the versions vulnerable to CVE-2016-3984?
Versions prior to Active Response 1.1.0.161, McAfee Agent 5.0.2 Hotfix 1110392, Data Exchange Layer 2.0.1.140.1, and various versions of Data Loss Prevention Endpoint are vulnerable to CVE-2016-3984.
Is there a workaround for CVE-2016-3984?
There is no official workaround for CVE-2016-3984; updating to a patched version is the recommended solution.