CVE-2020-7335
📋 TL;DR
This vulnerability allows local users on Windows systems running McAfee Total Protection to escalate privileges by exploiting a timing issue through junction link manipulation. It affects users with McAfee Total Protection versions prior to 16.0.29. The attack requires local access and careful timing within a small window.
💻 Affected Systems
- McAfee Total Protection (MTP)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains SYSTEM/administrator privileges, enabling complete system compromise, data theft, malware installation, and persistence.
Likely Case
Local user with limited privileges gains administrative access to install software, modify system settings, or access protected files.
If Mitigated
With proper patching, the vulnerability is eliminated; with user privilege restrictions, impact is limited to the compromised user account.
🎯 Exploit Status
Requires local access and precise timing within a small window. Exploit details are publicly documented but no public proof-of-concept is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.0.29 or later
Vendor Advisory: http://service.mcafee.com/FAQDocument.aspx?&id=TS103089
Restart Required: Yes
Instructions:
1. Open McAfee Total Protection. 2. Check for updates in the application. 3. Update to version 16.0.29 or later. 4. Restart the system as prompted.
🔧 Temporary Workarounds
Remove vulnerable McAfee version
windowsUninstall McAfee Total Protection versions prior to 16.0.29 and replace with updated version or alternative security software.
Control Panel > Programs > Uninstall a program > Select McAfee Total Protection > Uninstall
🧯 If You Can't Patch
- Restrict local user privileges to minimize impact if exploited
- Monitor for unusual privilege escalation attempts using endpoint detection tools
🔍 How to Verify
Check if Vulnerable:
Check McAfee Total Protection version in the application interface or via 'About' section. Versions below 16.0.29 are vulnerable.Check Version:
Not applicable via command line; check through McAfee Total Protection GUI.Verify Fix Applied:
Confirm version is 16.0.29 or higher in McAfee Total Protection interface.📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation events in Windows Security logs
- McAfee service errors or unexpected restarts
Network Indicators:
- None - local exploit only
SIEM Query:
EventID 4688 with process creation showing privilege escalation from non-admin to admin context on systems with McAfee Total Protection