Strix
26.1K

CVE-2005-3657

UnknownEPSS 2.32%

Last modified

CVE-2005-3657 is a vulnerability of currently unknown severity. The ActiveX control in MCINSCTL.DLL for McAfee VirusScan Security Center does not use the IObjectSafetySiteLock API to restrict access to required domains, which allows remote attackers to create or append to arbitrary files via the StartLog and AddLog methods in the MCINSTALL.McLog object.. EPSS estimates a 2.32% chance of exploitation in the next 30 days.

Description

The ActiveX control in MCINSCTL.DLL for McAfee VirusScan Security Center does not use the IObjectSafetySiteLock API to restrict access to required domains, which allows remote attackers to create or append to arbitrary files via the StartLog and AddLog methods in the MCINSTALL.McLog object.

Metrics

EPSS Probability
2.32%

81.3th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
McafeeMcinsctl.Dll4.0.0.83
McafeeVirusscan Security CenterAll versions
McafeeVirusscan Security Center4.0
McafeeVirusscan Security Center4.0.3
McafeeVirusscan Security Center4.5
McafeeVirusscan Security Center4.5.1
McafeeVirusscan Security Center5.0
McafeeVirusscan Security Center6.0
McafeeVirusscan Security Center7.0
McafeeVirusscan Security Center7.1
McafeeVirusscan Security Center8.0
McafeeVirusscan Security Center9.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2005-3657?
The ActiveX control in MCINSCTL.DLL for McAfee VirusScan Security Center does not use the IObjectSafetySiteLock API to restrict access to required domains, which allows remote attackers to create or append to arbitrary files via the StartLog and AddLog methods in the MCINSTALL.McLog object.
How severe is CVE-2005-3657?
Severity scoring for CVE-2005-3657 is pending analysis. The EPSS model estimates a 2.32% probability of exploitation in the next 30 days.
How do I fix CVE-2005-3657?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2005-3657?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST