What is affected by this security vulnerability?
See the Product Specific Notes section above.

 

 

McAfee recommends that all customers verify that they have applied the latest updates.

Does this vulnerability affect McAfee enterprise products?
Yes. Several enterprise products are vulnerable. No consumer products are vulnerable.

How do I know if my McAfee product is vulnerable or not?

For Endpoint products:
Use the following instructions for endpoint or client based products:

1. Right-click on the McAfee tray shield icon on the Windows task bar.
2. Select Open Console.
3. In the console, select Action Menu.
4. In the Action Menu, select Product Details. The product version is displayed.

For ePO / Server products:
Use the following instructions for server based products:

• Check the version and build of ePO that is installed. For more information on how to check the version, see: KB52634.
• Or, create a query in ePO for the product version of the product installed within your organization.

For Appliances:
Use the following instructions for Appliance based products:

1. Open the Administrator's User Interface (UI).
2. Click the About link. The product version is displayed.

For DLPe ePO Extension:
Use the following instructions:

1. Log on to the ePO server.
2. Click Menu, Data Protection, DLP Policy.
3. Inside the DLP console, click the Help menu item, About. The product version is displayed.

What is CVSS?
CVSS, or Common Vulnerability Scoring System, is the result of the National Infrastructure Advisory Council’s effort to standardize a system of assessing the criticality of a vulnerability. This system offers an unbiased criticality score between 0 and 10 that customers can use to judge how critical a vulnerability is and plan accordingly. For more information, please visit the CVSS website at: http://www.first.org/cvss/.

When calculating CVSS v2 scores, McAfee has adopted a philosophy that fosters consistency and repeatability. Our guiding principle for CVSS scoring is to score the exploit under consideration by itself. We consider only the immediate and direct impact of the exploit under consideration. We do not factor into a score any potential follow-on exploits that might be made possible by successful exploitation of the issue being scored. What are the CVSS scoring metrics that have been used?

CVE-2015-0235: GHOST Vulnerability

NOTE: CVSS version 2.0 was used to generate this score.
https://nvd.nist.gov/cvss.cfm?calculator&version=2&vector=(AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C)

NOTE: The CVSS base score was adjusted higher (10.0) since NIST (http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0235) scored the CVE. The initial score (6.8) was from RedHat: https://access.redhat.com/security/cve/CVE-2015-0235. What has McAfee done to resolve the issue?
McAfee will be releasing several product updates to address this security flaw.

Where do I download the fix?
You can download the fix from: https://www.mcafee.com/enterprise/en-us/downloads/my-products.html.
Users will need to provide their McAfee Grant Number to initiate the download.

How does McAfee respond to this and any other security flaws?
McAfee’s key priority is the security of our customers. In the event that a vulnerability is found within any of McAfee’s software, we work closely with the relevant security research group to ensure rapid and effective development of a fix and communication plan.

McAfee only publishes product vulnerability bulletins together with an actionable workaround, hotfix, patch, or version update; otherwise we would simply be informing the hacker community that our products are a target, putting our customers at greater risk. 

McAfee may publish lists of known vulnerable and not vulnerable products if the product vulnerability is already generally known publicly, but no actionable workaround is ready yet.

 

Where can I find a list of all Security Bulletins?
To view all published Security Bulletins, visit the McAfee ServicePortal at https://mysupport.mcafee.com, click Knowledge Center, and select Security Bulletins in the left navigation pane under Content Source. Alternatively, you can use this link: https://support.mcafee.com/ServicePortal/faces/knowledgecenter?s=true&lang=en-us&sm=false&tab=SCtdl&facets=Security+Bulletin@INQUIRA_TYPE&sb=mostViewed&sbv=numberofviews%3Anumberdecreasing&scps=q.

 

If you know the Security Bulletin ID, use the following link after replacing the example Security Bulletin ID (SB10071) with the Security Bulletin ID you are searching for: https://kc.mcafee.com/corporate/index?page=content&id=SB10071.

 

How do I report a product vulnerability?
If you have information about a security issue or vulnerability with a McAfee product, please visit our product security website at: http://www.mcafee.com/us/threat-center/product-security-bulletins.aspx#=tab-vulnerability.