CVE-2016-1715

The swin.sys kernel driver in McAfee Application Control (MAC) 6.1.0 before build 706, 6.1.1 before build 404, 6.1.2 before build 449, 6.1.3 before build 441, and 6.2.0 before build 505 on 32-bit Windows platforms allows local users to cause a denial of service (memory corruption and system crash) or gain privileges via a 768 syscall, which triggers a zero to be written to an arbitrary kernel memory location.

CVSS v3.0 6.6 MEDIUM
CVSS v2.0 5.5 MEDIUM

6.6^/10

CVSS v3.0 : MEDIUM

Vector : AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:H

Exploitability : 0.8 / Impact : 5.3

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope CHANGED

5.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:S/C:P/I:P/A:C

Exploitability : 2.7 / Impact : 8.5

Access Vector LOCAL

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact COMPLETE

References

Link	Resource
http://www.zerodayinitiative.com/advisories/ZDI-16-007
https://kc.mcafee.com/corporate/index?page=content&id=SB10145	Patch Vendor Advisory

Advertisement

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:x86:*

OR	cpe:2.3:a:mcafee:application_control:6.1.3:::::::*
	cpe:2.3:a:mcafee:application_control:6.2.0:::::::*
	cpe:2.3:a:mcafee:application_control:6.1.1:::::::*
	cpe:2.3:a:mcafee:application_control:6.1.0:::::::*
	cpe:2.3:a:mcafee:application_control:6.1.2:::::::*

Information

Published : 2016-01-12 12:59

Updated : 2016-01-21 09:06

NVD link : CVE-2016-1715

Mitre link : CVE-2016-1715

JSON object : View

CWE

CWE-189

Numeric Errors

Advertisement

Products Affected

mcafee

application_control

microsoft

windows

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.zerodayinitiative.com/advisories/ZDI-16-007", "name": "http://www.zerodayinitiative.com/advisories/ZDI-16-007", "tags": [], "refsource": "MISC"}, {"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10145", "name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10145", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The swin.sys kernel driver in McAfee Application Control (MAC) 6.1.0 before build 706, 6.1.1 before build 404, 6.1.2 before build 449, 6.1.3 before build 441, and 6.2.0 before build 505 on 32-bit Windows platforms allows local users to cause a denial of service (memory corruption and system crash) or gain privileges via a 768 syscall, which triggers a zero to be written to an arbitrary kernel memory location."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-189"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2016-1715", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.5, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:S/C:P/I:P/A:C", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 8.5, "obtainAllPrivilege": false, "exploitabilityScore": 2.7, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}, "baseMetricV3": {"cvssV3": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 5.3, "exploitabilityScore": 0.8}}, "publishedDate": "2016-01-12T20:59Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:mcafee:application_control:6.1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mcafee:application_control:6.2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mcafee:application_control:6.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mcafee:application_control:6.1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mcafee:application_control:6.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2016-01-21T17:06Z"}