McAfee DLP Agent Stack Buffer Overflow RCE

EIP-2015-0041

The vulnerability affects both Data Loss Prevention (DLP) Endpoint for Windows and the DLP Discover products from McAfee. The vulnerability is present within the included lasr.dll module, which is part of the Keyview SDK3 , and is responsible for parsing Ami Pro (.sam) files during server content inspection. A file format parsing vulnerability results in a stack-based buffer overflow that can be abused to achieve remote code execution.

Vulnerability Identifiers

Exodus Intelligence: EIP-2015-0041
MITRE CVE: CVE-2021-31844, CVE-2021-31845

Vulnerability Metrics

CVSS Score: 8.2

Vendor References

https://kc.mcafee.com/corporate/index?page=content&id=SB10368

Discovery Credit

Exodus Intelligence

Disclosure Timeline

Disclosed to affected vendor: February 24th, 2021
Disclosed to public: September 14th, 2021

Further Information

Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at [email protected].

Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.

The post McAfee DLP Agent Stack Buffer Overflow RCE appeared first on Exodus Intelligence.

Support the originator by clicking the read the rest link below.