CVE-2019-3636 File masquerade attack vulnerability in McAfee Total Protection
Attackers can read antivirus exclusion lists from the registry and replace excluded files with malware, bypassing detection in McAfee Total Protection.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-3636?
CVE-2019-3636 is a high-severity vulnerability in McAfee, LCC McAfee Total Protection, published on 28 Oct 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A File Masquerade vulnerability in McAfee Total Protection (MTP) version 16.0.R21 and earlier in Windows client allowed an attacker to read the plaintext list of AV-Scan exclusion files from the Windows registry, and to possibly replace excluded files with potential malware without being detected.
Weakness: CWE-312
Which versions are affected by CVE-2019-3636?
It affects 1 product.
Products include Mcafee Total Protection.
How do I fix CVE-2019-3636?
No fix has been published for CVE-2019-3636 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-3636 being exploited?
There is no known exploitation of CVE-2019-3636 in the wild and no public exploit code.
Other vulnerabilities in McAfee, LCC McAfee Total Protection
- CVE-2021-23874 McAfee Total Protection (MTP) Improper Privilege Management
- CVE-2023-24579 Security feature bypass in n/a
- CVE-2022-43751 Path traversal in n/a
- CVE-2021-23872 Privilege Escalation vulnerability in McAfee Total Protection (MTP)
- CVE-2021-23891 Privilege Escalation vulnerability in McAfee Total Protection (MTP)
Sources
Also known as GHSA-fcqr-w4fr-6f6x.