Advisory Details

January 8th, 2016

McAfee Application Control Kernel Driver Memory Corruption Privilege Escalation Vulnerability

CVE ID	CVE-2016-1715
CVSS SCORE	6.6, AV:L/AC:M/Au:S/C:C/I:C/A:C
AFFECTED VENDORS	McAfee
AFFECTED PRODUCTS	Application Control
VULNERABILITY DETAILS	This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of McAfee Application Control. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within processing of syscall 768 in the swin.sys kernel driver. A malicious call can write a 0 to an arbitrary address in kernel memory. An attacker can leverage this vulnerability to execute arbitrary code in the context of SYSTEM.
ADDITIONAL DETAILS	McAfee has issued an update to correct this vulnerability. More details can be found at: https://kc.mcafee.com/corporate/index?page=content&id=SB10145
DISCLOSURE TIMELINE	2015-09-17 - Vulnerability reported to vendor 2016-01-08 - Coordinated public release of advisory
CREDIT	Anonymous

BACK TO ADVISORIES