McAfee Security Bulletin – McAfee addresses local privilege escalation in legacy trial installer for McAfee Total Protection (CVE-2024-49592) – Zendesk

This Security Bulletin describes an update to McAfee's legacy trial installer software that is now End of Life.

Product	Impacted Versions	CVE ID	Impact	Severity Ratings	CVSS v3.1 Base/Temporal Scores
Trial installer for McAfee Total Protection	16.0.53	CVE-2024-49592	CWE-427: Uncontrolled Search Path Element	Medium	6.7 / 6.0
Recommendations:	Install or update to the latest versions.
Security Bulletin Replacement:	None
Location of updated software:	https://www.mcafee.com/

Article contents:

Description

CVE-2024-49592
During installation, McAfee’s legacy free trial version of McAfee Total Protection (which is End of Life and has been replaced with our most current product) might allow an adversary or knowledgeable user to perform a DLL-squatting attack, which could lead to a local privilege escalation.

This was only possible if the adversary or knowledgeable user was squatting on the system prior to install of the free trial.

This vulnerability did not impact other versions of McAfee software and/or trial versions of the software that are already installed.

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-49592

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49592

How to Fix

The potential for this issue to occur on a legacy trial installer has been removed with the replacement of the trial product with our most current version.

If the user has downloaded, but not installed, the legacy free trial of McAfee Total Protection, we recommend downloading and installing the most recent version of McAfee software instead. 

Download and Installation Instructions
For instructions, see How to download and install McAfee products.

Acknowledgments

McAfee credits Eduardo Braun Prado working with Trend Micro Zero Day Initiative for responsibly reporting this potential issue. 

Frequently Asked Questions
What is CVSS?
CVSS, or Common Vulnerability Scoring System, is the National Infrastructure Advisory Council’s standard system for assessing vulnerabilities. This system offers a score between 0 and 10 that can be used to rate how critical a vulnerability is. For more info, visit the CVSS website at: www.first.org/cvss/.

When calculating CVSS scores, we only look at the exploit itself and any of its immediate or direct effects. We don’t consider other exploits that might occur due to the successful exploitation of the issue being scored.

What are the CVSS scoring metrics?

CVE-2024-49592: Legacy Trial installer for McAfee Total Protection Local Privilege Escalation Vulnerability

Base Score	6.7
Attack Vector (AV)	Local (L)
Attack Complexity (AC)	High (H)
Privileges Required (PR)	Low (L)
User Interaction (UI)	Required (R)
Scope (S)	Unchanged (U)
Confidentiality (C)	High (H)
Integrity (I)	High (H)
Availability (A)	High (H)
Temporal Score (Overall)	6.0
Exploitability (E)	Proof-of-Concept (P)
Remediation Level (RL)	Official Fix (O)
Report Confidence (RC)	Confirmed (C)

NOTE: The following CVSS version 3.1 vector was used to generate this score.
www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C  

Where can I find a list of all Security Bulletins?
All Security Bulletins are published on our Service Portal at www.mcafee.com/support/s/. Security Bulletins are removed when the product reaches End of Sale and End of Support (End of Life).

How do I report a security flaw in a McAfee product?
You can reach out to us through the McAfee Product Security Incident Response Team (PSIRT) website. Follow the steps under Report a Security Vulnerability.

How does McAfee respond to this and any other reported security flaws?
Our key priority is the security of our customers. If a security flaw is found in any McAfee app or service, we work with our software development team to produce a rapid and effective fix.

McAfee only publishes Security Bulletins if they include something actionable, such as a workaround, fix, version update, or hotfix. Otherwise, we would simply be telling the hacker community that our products are a target, putting our customers at greater risk. For products that auto-update, a non-actionable Security Bulletin might be published to acknowledge the discoverer.

You can learn more about the PSIRT policy by visiting the McAfee PSIRT website, and scrolling down to PSIRT Policy Statements.

Resources
To contact Customer Service, go to mcafee.com/support/s/contactsupport.

Disclaimer

The information provided in this Security Bulletin is provided as is without warranty of any kind. McAfee disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall McAfee or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if McAfee or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the preceding limitation may not apply.

Any future product release dates mentioned in this Security Bulletin are intended to outline our general product direction, and they should not be relied on in making a purchasing decision. The product release dates are for information purposes only, and may not be incorporated into any contract. The product release dates are not a commitment, promise, or legal obligation to deliver any material, code, or functionality. The development, release, and timing of any features or functionality described for our products remains at our sole discretion and may be changed or canceled at any time.