Multiple McAfee endpoint products include a self-protection mechanism to determine which McAfee applications and associated actions, such as access to registry keys and files, can be trusted. The mechanism allows exclusions to prevent dead locks and infinite loops when multiple scanners are involved.  

Trusted applications can access settings and files protected by self-protection rules. For example, McAfee applications must be trusted before they are allowed to be uninstalled, preventing malicious attackers from uninstalling McAfee software without permission. After an attacker achieves local Windows administrative privileges, the self-protection mechanism can also be manipulated to control trust settings without possession of the management password.

The affected self-protection mechanism design is outdated and was being replaced. The replacement design was in development for several years and has now been included in the affected products. When VSE is present on the device, processes that attempt to use this mechanism are scanned upon access. If the processes are not detected as malware, they could gain access to resources protected by McAfee products.

This update also addresses another issue that was very specific to the VSE product where closing the registry handles for the VSE process mcconsole.exe using Process Explorer (or similar tools) could be exploited to unlock the password protected VirusScan Console window. See SB10158 for additional details.

See the discoverer’s blog report at: https://packetstormsecurity.com/files/136089. Products are grouped in two categories:

• Category 1 Products:
  Ship the vulnerable technology and actively use the technology for their own self-protection or protection they offer to other McAfee products installed on the same device.
   
• Category 2 Products:
  Ship the vulnerable technology, but have already transitioned to a new self-protection mechanism that does not rely on the vulnerable technology. They still require an update to fully disable the vulnerable technology.

This trusted access bypass vulnerability allows access to resources normally protected by the products. Someone with knowledge of this mechanism can use and exploit it. An attacker who has access to the computer with local admin rights could potentially use this vulnerability to bypass product self-protection and tamper with policies and product files. The patches and hotfixes in the Remediation table remediate this issue for the following products:

• Category 1:
  • VirusScan Enterprise (VSE)
   
• Category 2:
  • Data Exchange Layer (DXL)
  • Host Intrusion Prevention Service (Host IPS)
  • McAfee Active Response (MAR)
  • McAfee Agent (MA)
  • McAfee Data Loss Prevention Endpoint (DLPe)
  • McAfee Device Control (MDC)
  • McAfee Endpoint Security (ENS)

CVE-2016-3984
The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL) before 2.0.1.140.1, Data Loss Prevention Endpoint (DLPe) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Device Control (MDC) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Endpoint Security (ENS) 10.x before 10.1, Host Intrusion Prevention Service (IPS) 8.0 before 8.0.0.3624, and VirusScan Enterprise (VSE) 8.8 before P7 (8.8.0.1528) on Windows allows local administrators to bypass intended self-protection rules and disable the antivirus engine by modifying registry keys.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3984

CWE-592
Application Protections Bypass
http://cwe.mitre.org/data/definitions/592.html