CVE-2022-0166: Privilege escalation vulnerability in McAfee Agent
A privilege escalation vulnerability in the McAfee Agent prior to 5.7.5. McAfee Agent uses openssl.cnf during the build process to specify the OPENSSLDIR variable as a subdirectory within the installation directory. A low privilege user could have created subdirectories and executed arbitrary code with SYSTEM privileges by creating the appropriate pathway to the specifically created malicious openssl.cnf file.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-0166?
CVE-2022-0166 is a privilege escalation vulnerability in the McAfee Agent prior to 5.7.5.
What is the severity of CVE-2022-0166?
CVE-2022-0166 has a severity score of 7.8 (High).
How does CVE-2022-0166 affect McAfee Agent?
CVE-2022-0166 affects McAfee Agent versions prior to 5.7.5.
How can CVE-2022-0166 be exploited?
CVE-2022-0166 can be exploited by a low privilege user to create subdirectories and execute arbitrary code.
How can I fix CVE-2022-0166?
To fix CVE-2022-0166, users should upgrade to McAfee Agent version 5.7.5 or later.