CVE-2018-6706 - OpenCVE

Insecure handling of temporary files in non-Windows McAfee Agent 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows an Unprivileged User to introduce custom paths during agent installation in Linux via unspecified vectors.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:N/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Mcafee	Agent

Configuration 1 [-]

OR	cpe:2.3:a:mcafee:agent::::::::
	cpe:2.3:a:mcafee:agent:5.5.0:::::::*
	cpe:2.3:a:mcafee:agent:5.5.1:::::::*

No data.

References

Link	Providers
http://www.securityfocus.com/bid/106328
https://kc.mcafee.com/corporate/index?page=content&id=SB10260

History

No history.

MITRE

Status: PUBLISHED

Assigner: trellix

Published: 2018-12-12T23:00:00

Updated: 2024-08-05T06:10:11.248Z

Reserved: 2018-02-06T00:00:00

Link: CVE-2018-6706

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-12-12T23:29:00.200

Modified: 2023-11-07T03:00:29.967

Link: CVE-2018-6706

Redhat

No data.

{"containers": {"cna": {"affected": [{"platforms": ["x86"], "product": "McAfee Agent (MA) for Linux", "vendor": "McAfee", "versions": [{"status": "affected", "version": "5.5.0"}, {"status": "affected", "version": "5.5.1"}, {"lessThan": "5.0.0*", "status": "affected", "version": "5.0.0", "versionType": "custom"}, {"lessThanOrEqual": "5.0.6", "status": "affected", "version": "5.0.6", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "McAfee credits Brandon Vincent for discovery of this vulnerability"}], "datePublic": "2018-12-12T00:00:00", "descriptions": [{"lang": "en", "value": "Insecure handling of temporary files in non-Windows McAfee Agent 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows an Unprivileged User to introduce custom paths during agent installation in Linux via unspecified vectors."}], "metrics": [{"cvssV3_0": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-377", "description": "Insecure Temporary File (CWE-377)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2018-12-27T10:57:01", "orgId": "01626437-bf8f-4d1c-912a-893b5eb04808", "shortName": "trellix"}, "references": [{"name": "106328", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/106328"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10260"}], "solutions": [{"lang": "en", "value": "McAfee highly recommends that all customers upgrade to McAfee Agent 5.6.0."}], "source": {"advisory": "SB10260", "discovery": "EXTERNAL"}, "title": "McAfee Agent (MA) non-Windows versions incorrect use of temporary file vulnerability ", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@mcafee.com", "ID": "CVE-2018-6706", "STATE": "PUBLIC", "TITLE": "McAfee Agent (MA) non-Windows versions incorrect use of temporary file vulnerability "}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "McAfee Agent (MA) for Linux", "version": {"version_data": [{"affected": ">=", "platform": "x86", "version_affected": ">=", "version_name": "5.0.0", "version_value": "5.0.0"}, {"affected": "<=", "platform": "x86", "version_affected": "<=", "version_name": "5.0.6", "version_value": "5.0.6"}, {"affected": "=", "platform": "x86", "version_affected": "=", "version_name": "5.5.0", "version_value": "5.5.0"}, {"affected": "=", "platform": "x86", "version_affected": "=", "version_name": "5.5.1", "version_value": "5.5.1"}]}}]}, "vendor_name": "McAfee"}]}}, "credit": [{"lang": "eng", "value": "McAfee credits Brandon Vincent for discovery of this vulnerability"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Insecure handling of temporary files in non-Windows McAfee Agent 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows an Unprivileged User to introduce custom paths during agent installation in Linux via unspecified vectors."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Insecure Temporary File (CWE-377)"}]}]}, "references": {"reference_data": [{"name": "106328", "refsource": "BID", "url": "http://www.securityfocus.com/bid/106328"}, {"name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10260", "refsource": "CONFIRM", "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10260"}]}, "solution": [{"lang": "en", "value": "McAfee highly recommends that all customers upgrade to McAfee Agent 5.6.0."}], "source": {"advisory": "SB10260", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T06:10:11.248Z"}, "title": "CVE Program Container", "references": [{"name": "106328", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/106328"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10260"}]}]}, "cveMetadata": {"assignerOrgId": "01626437-bf8f-4d1c-912a-893b5eb04808", "assignerShortName": "trellix", "cveId": "CVE-2018-6706", "datePublished": "2018-12-12T23:00:00", "dateReserved": "2018-02-06T00:00:00", "dateUpdated": "2024-08-05T06:10:11.248Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mcafee:agent:*:*:*:*:*:*:*:*", "matchCriteriaId": "8C64E5EC-8233-436C-8C4A-81EC34B3D15E", "versionEndIncluding": "5.0.6", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:agent:5.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "29BD74B8-8FF2-4C74-9B9B-DB5C404E5915", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:agent:5.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "0A7A7F4E-8425-4518-874A-4D9B0BF6B032", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insecure handling of temporary files in non-Windows McAfee Agent 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows an Unprivileged User to introduce custom paths during agent installation in Linux via unspecified vectors."}, {"lang": "es", "value": "El manejo inseguro de los archivos temporales en McAfee Agent para plataformas diferentes de Windows, desde la versi\u00f3n 5.0.0 hasta la 5.0.6, 5.5.0 y 5.5.1, permite que un usuario sin privilegios introduzca rutas personalizadas durante la instalaci\u00f3n de agentes en Linux mediante vectores sin especificar."}], "id": "CVE-2018-6706", "lastModified": "2023-11-07T03:00:29.967", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 0.6, "impactScore": 1.4, "source": "trellixpsirt@trellix.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-12-12T23:29:00.200", "references": [{"source": "trellixpsirt@trellix.com", "url": "http://www.securityfocus.com/bid/106328"}, {"source": "trellixpsirt@trellix.com", "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10260"}], "sourceIdentifier": "trellixpsirt@trellix.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-377"}], "source": "trellixpsirt@trellix.com", "type": "Secondary"}]}