« Volver al listado

CVE-2016-8021

Estado: ModificadaMedia (5)—

Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to spoof update server and execute arbitrary code via a crafted input file.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mcafee — Virusscan Enterprise

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-8021",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.3
      }
    ]
  },
  "affected": [
    {
      "source": "secure@intel.com",
      "affectedData": [
        {
          "vendor": "Intel",
          "product": "VirusScan Enterprise Linux (VSEL)",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.3 (and earlier)"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-03-14T22:59:01.023",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/94823",
      "source": "secure@intel.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1037433",
      "source": "secure@intel.com"
    },
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10181",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@intel.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/40911/",
      "source": "secure@intel.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/94823",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1037433",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10181",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/40911/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to spoof update server and execute arbitrary code via a crafted input file."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de verificación inapropiada de firma criptográfica en Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (y versiones anteriores) permite a usuarios remotos autenticados suplantar el servidor de actualización y ejecutar código arbitrario a través de un archivo de entrada manipulado."
    }
  ],
  "lastModified": "2026-06-17T00:53:56.610",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcafee:virusscan_enterprise:*:*:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4CE62F4-8171-49DF-89D2-B64D26F562EA",
              "versionEndIncluding": "2.0.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@intel.com"
}