Vulnerabilities > CVE-2006-3961 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Mcafee products

CVSS 6.8 - MEDIUM

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

mcafee

CWE-119

exploit available

metasploit

NVD

Published: 2006-08-01

Updated: 2018-10-17

Summary

Buffer overflow in McSubMgr ActiveX control (mcsubmgr.dll) in McAfee Security Center 6.0.23 for Internet Security Suite 2006, Wireless Home Network Security, Personal Firewall Plus, VirusScan, Privacy Service, SpamKiller, AntiSpyware, and QuickClean allows remote user-assisted attackers to execute arbitrary commands via long string parameters, which are later used in vsprintf.

Vulnerable Configurations

Part	Description	Count
Application	Mcafee Mcafee Antispyware 2005 Mcafee Antispyware 2006 Mcafee Internet Security Suite 2004 Mcafee Internet Security Suite 2005 Mcafee Internet Security Suite 2006 Mcafee Personal Firewall Plus 2004 Mcafee Personal Firewall Plus 2005 Mcafee Personal Firewall Plus 2006 Mcafee Privacy Service 2004 Mcafee Privacy Service 2005 Mcafee Privacy Service 2006 Mcafee Quickclean 2004 Mcafee Quickclean 2005 Mcafee Quickclean 2006 Mcafee Security Center 4.3 Mcafee Security Center 6.0 Mcafee Security Center 6.0.22 Mcafee Security Center 6.0.23 Mcafee Spamkiller 5.0 Mcafee Spamkiller 6.0 Mcafee Spamkiller 7.0 Mcafee Virusscan 2004 Mcafee Virusscan 2005 Mcafee Virusscan 2006 Mcafee Wireless Home Network Security 2006	25

Common Weakness Enumeration (CWE)

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Common Attack Pattern Enumeration and Classification (CAPEC)

Buffer Overflow via Environment Variables
This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
Overflow Buffers
Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
Client-side Injection-induced Buffer Overflow
This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
Filter Failure through Buffer Overflow
In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
MIME Conversion
An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Exploit-Db

description	McAfee Subscription Manager Stack Buffer Overflow. CVE-2006-3961. Remote exploit for windows platform
id	EDB-ID:16510
last seen	2016-02-02
modified	2010-07-03
published	2010-07-03
reporter	metasploit
source	https://www.exploit-db.com/download/16510/
title	McAfee Subscription Manager Stack Buffer Overflow

Metasploit

description	This module exploits a flaw in the McAfee Subscription Manager ActiveX control. Due to an unsafe use of vsprintf, it is possible to trigger a stack buffer overflow by passing a large string to one of the COM-exposed routines, such as IsAppExpired. This vulnerability was discovered by Karl Lynn of eEye.
id	MSF:EXPLOIT/WINDOWS/BROWSER/MCAFEE_MCSUBMGR_VSPRINTF
last seen	2020-06-13
modified	2017-07-24
published	2006-08-14
references	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3961
reporter	Rapid7
source	https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/browser/mcafee_mcsubmgr_vsprintf.rb
title	McAfee Subscription Manager Stack Buffer Overflow

Packetstorm

data source	https://packetstormsecurity.com/files/download/82987/mcafee_mcsubmgr_vsprintf.rb.txt
id	PACKETSTORM:82987
last seen	2016-12-05
published	2009-11-26
reporter	skape
source	https://packetstormsecurity.com/files/82987/McAfee-Subscription-Manager-Stack-Overflow.html
title	McAfee Subscription Manager Stack Overflow

Saint

bid	19265
description	McAfee Subscription Manager ActiveX buffer overflow
id	misc_av_mcafeesubmgr
osvdb	27698
title	mcafee_subscription_manager
type	client

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Exploit-Db

Metasploit

Packetstorm

Saint

References