Vulnerability Solutions

The Nimsoft Cloud Monitor Periodic Vulnerability Scan checks for the vulnerability below. To see the most recently added vulnerability solutions that are scanned by WatchMouse, go to the Vulnerability Solutions overview

Category: Windows Risk factor: High Added: 29 Jan 2012
Synopsis:

The remote Windows host has an ActiveX control that could be abused to execute arbitrary code remotely.

Description:

The myCIOScn.dll ActiveX control, installed on the remote Windows host as part of McAfee Security-as-a-Service (SaaS) / Total Protection
Service, reportedly does not require authentication before executing arbitrary commands passed to its 'ShowReport' method.

If an attacker can trick a user on the affected host into visiting a specially crafted web page, he may be able to leverage this issue to execute arbitrary code on the host subject to the user's privileges.

See also:

http://www.zerodayinitiative.com/advisories/ZDI-12-012
http://www.securityfocus.com/archive/1/521245/30/0/threaded
https://kc.mcafee.com/corporate/index?page=content&id=KB73910

Solution:

Set the kill bit for the affected control.

Note that McAfee reportedly removed the 'Safe for Scripting' designation for the control in SaaS Endpoint Protection 5.2.2 in August 2011 as part of a fix for a related issue and which should significantly migitate exploitation of this issue. In addition, McAfee plans to address the issue completely at some point in the future by removing the affected code entirely as part of its automatic
patching.

Risk factor:

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)