CVE-2019-3663 Advanced Threat Defense (ATD) - Unprotected storage of shared credentials vulnerability
Local attackers can access sensitive files to retrieve the common root password, gaining full system control on McAfee ATD instances.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3663?
CVE-2019-3663 is a critical vulnerability in McAfee Advanced Threat Defense (ATD), published on 13 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unprotected Storage of Credentials vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows local attacker to gain access to the root password via accessing sensitive files on the system. This was originally published with a CVSS rating of High, further investigation has resulted in this being updated to Critical. The root password is common across all instances of ATD prior to 4.8. See the Security bulletin for further details
Weakness: CWE-522
Which versions are affected by CVE-2019-3663?
It affects 1 product.
Products include Mcafee Advanced Threat Defense.
How do I fix CVE-2019-3663?
No fix has been published for CVE-2019-3663 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-3663 being exploited?
There is no known exploitation of CVE-2019-3663 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in McAfee Advanced Threat Defense (ATD)
- CVE-2017-4052 Auth bypass in Advanced Threat Defense (ATD)
- CVE-2017-4053 Command injection in Advanced Threat Defense (ATD)
- CVE-2019-3651 Advanced Threat Defense (ATD) - Information Disclosure vulnerability
- CVE-2017-4054 Command injection in Advanced Threat Defense (ATD)
- CVE-2017-4057 Privilege escalation in Advanced Threat Defense (ATD)
Sources
Also known as GHSA-538g-8rx5-rhf7.