CVE-2021-31847: McAfee Endpoint Security Incorrect Permission Assignment Privilege Escalation Vulnerability
Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloading attack using unsigned DLLs. This would result in elevation of privileges and the ability to execute arbitrary code as the system user, through not correctly protecting a temporary directory used in the repair process and not checking the DLL signature.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of McAfee Endpoint Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the installer. The issue results from incorrect permissions set on a resource used by the installer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-31847?
The severity of CVE-2021-31847 is high with a severity value of 7.8.
How can an attacker exploit CVE-2021-31847?
An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit CVE-2021-31847.
What versions of McAfee Endpoint Security are affected by CVE-2021-31847?
McAfee Endpoint Security versions up to and excluding 5.7.4 are affected by CVE-2021-31847.
How can I fix CVE-2021-31847?
Update McAfee Endpoint Security to a version higher than 5.7.4 to fix CVE-2021-31847.
Where can I find more information about CVE-2021-31847?
You can find more information about CVE-2021-31847 in the following references: [McAfee Knowledge Center](https://kc.mcafee.com/corporate/index?page=content&id=SB10369) and [Zero Day Initiative Advisories](https://www.zerodayinitiative.com/advisories/ZDI-21-1104/).