Vulnerability · Published Sep 17, 2021 · Assigned by trellix

CVE-2021-31844Local Privilege Escalation in McAfee DLP Endpoint for Windows

High 8.2

In plain English

A high-severity buffer overflow in McAfee Data Loss Prevention (DLP) Endpoint for Windows from McAfee,LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.4%top 68.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a local attacker to execute arbitrary code with elevated privileges through placing carefully constructed Ami Pro (.sam) files onto the local system and triggering a DLP Endpoint scan through accessing a file. This is caused by the destination buffer being of fixed size and incorrect checks being made on the source size.

Affected products (as reported)

Vendor	Product	Versions
McAfee,LLC	McAfee Data Loss Prevention (DLP) Endpoint for Windows	unspecified – before 10.6.200

Weakness: CWE-120 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10368 x_refsource_CONFIRM