CVE-2020-7279:DLL Search Order Hijacking Vulnerability in McAfee Host Intrusion Prevention System (Host IPS) for Windows

splash
Back

Description Preview

A DLL Search Order Hijacking vulnerability (CWE-426) exists in the installer component of McAfee Host Intrusion Prevention System (Host IPS) for Windows versions prior to 8.0.0 Patch 15 Update. This vulnerability allows attackers with local access to execute arbitrary code by placing malicious DLL files in a compromised folder that the installer searches when loading libraries.

Overview

This vulnerability affects the McAfee Host Intrusion Prevention System (Host IPS) for Windows, a security product designed to protect systems from intrusions. The installer component of this software is vulnerable to DLL search order hijacking, which occurs when an application searches for external libraries in an insecure manner. When the installer runs, it may load DLLs from the current working directory or other locations before checking in secure system directories. An attacker with local access could exploit this by placing malicious DLLs in directories where the installer searches, leading to arbitrary code execution with the privileges of the user running the installer, potentially including administrative privileges.

Remediation

Organizations using McAfee Host Intrusion Prevention System (Host IPS) for Windows should:

  1. Update to version 8.0.0 Patch 15 Update or later which addresses this vulnerability.
  2. If immediate patching is not possible, implement the following mitigations:
    • Restrict access to local file systems where the application is installed
    • Monitor for suspicious file creation activities in application directories
    • Ensure proper privilege management for users who can access the system
  3. Follow the guidance provided in McAfee Security Bulletin SB10320 for specific update instructions.

References

  1. McAfee Security Bulletin SB10320: https://kc.mcafee.com/corporate/index?page=content&id=SB10320
  2. CWE-426: Untrusted Search Path: https://cwe.mitre.org/data/definitions/426.html
  3. MITRE CVE-2020-7279: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7279

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Finance and Insurance
    Finance and Insurance
  2. Health Care & Social Assistance
    Health Care & Social Assistance
  3. Public Administration
    Public Administration
  4. Manufacturing
    Manufacturing
  5. Educational Services
    Educational Services
  6. Arts, Entertainment & Recreation
    Arts, Entertainment & Recreation
  7. Transportation & Warehousing
    Transportation & Warehousing
  8. Accommodation & Food Services
    Accommodation & Food Services
  9. Administrative, Support, Waste Management & Remediation Services
    Administrative, Support, Waste Management & Remediation Services
  10. Agriculture, Forestry Fishing & Hunting
    Agriculture, Forestry Fishing & Hunting
  11. Construction
    Construction
  12. Information
    Information
  13. Management of Companies & Enterprises
    Management of Companies & Enterprises
  14. Mining
    Mining
  15. Other Services (except Public Administration)
    Other Services (except Public Administration)
  16. Professional, Scientific, & Technical Services
    Professional, Scientific, & Technical Services
  17. Real Estate Rental & Leasing
    Real Estate Rental & Leasing
  18. Retail Trade
    Retail Trade
  19. Utilities
    Utilities
  20. Wholesale Trade
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background