VulnerabilityModified
CVE-2005-3657
The ActiveX control in MCINSCTL.DLL for McAfee VirusScan Security Center does not use the IObjectSafetySiteLock API to restrict access to required domains, which allows remote attackers to create or append to arbitrary files via the StartLog and AddLog…
MEDIUM 5.0EPSS 2.32%
Does this matter?
Lower severity and a low EPSS score (2.32%). Track it; it rarely justifies an emergency change on its own.
Description
The ActiveX control in MCINSCTL.DLL for McAfee VirusScan Security Center does not use the IObjectSafetySiteLock API to restrict access to required domains, which allows remote attackers to create or append to arbitrary files via the StartLog and AddLog methods in the MCINSTALL.McLog object.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
- EPSS
- 2.32% probability · 82th percentile
- CISA KEV
- Not listed
- Affected
- mcafee/mcinsctl.dll · mcafee/virusscan security center
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/18169
- http://securityreason.com/securityalert/279
- http://securitytracker.com/id?1015390
- http://www.idefense.com/intelligence/vulnerabilities/display.php?id=358Vendor Advisory
- http://www.securityfocus.com/bid/15986
- http://www.vupen.com/english/advisories/2005/3006
- http://secunia.com/advisories/18169
- http://securityreason.com/securityalert/279
- http://securitytracker.com/id?1015390
- http://www.idefense.com/intelligence/vulnerabilities/display.php?id=358Vendor Advisory
- http://www.securityfocus.com/bid/15986
- http://www.vupen.com/english/advisories/2005/3006
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.