CVE-2018-6693: mcafee endpoint_security_for_linux_threat_prevention

Vulnerability summary

CVE-2018-6693 is a medium (CVSS 5.6) vulnerability in mcafee endpoint_security_for_linux_threat_prevention. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.2% of scored vulnerabilities.

Timeline

1. 18-09-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escalation to delete arbitrary files.

• CWE-274Improper Handling of Insufficient PrivilegesThe product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
• CWE-363Race Condition Enabling Link FollowingThe product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.
• CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.