CVE-2021-23873
📋 TL;DR
This vulnerability allows a local user on a Windows system to escalate privileges to SYSTEM level and delete arbitrary files, potentially causing denial of service. It affects McAfee Total Protection (MTP) users with versions before 16.0.30. Attackers can exploit this by manipulating junction links at specific times after enumerating certain files.
💻 Affected Systems
- McAfee Total Protection (MTP)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via SYSTEM privilege escalation leading to arbitrary file deletion, service disruption, and potential persistence mechanisms installation.
Likely Case
Local privilege escalation allowing attackers to delete critical system files, causing denial of service and potentially enabling further attacks.
If Mitigated
Limited impact with proper access controls and monitoring, though local users could still cause service disruption.
🎯 Exploit Status
Exploitation requires local access and specific timing conditions with junction link manipulation. The vulnerability has been publicly disclosed with technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.0.30 or later
Vendor Advisory: http://service.mcafee.com/FAQDocument.aspx?&id=TS103114
Restart Required: Yes
Instructions:
1. Open McAfee Total Protection. 2. Check for updates in the application. 3. Update to version 16.0.30 or later. 4. Restart the system to complete the update.
🔧 Temporary Workarounds
Restrict local user access
windowsLimit local user accounts and implement least privilege principles to reduce attack surface.
Monitor junction link creation
windowsImplement monitoring for junction link creation and manipulation in McAfee directories.
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges
- Monitor for suspicious file deletion activities and junction link manipulation
🔍 How to Verify
Check if Vulnerable:
Check McAfee Total Protection version in the application interface or via Windows Programs and Features. If version is below 16.0.30, the system is vulnerable.Check Version:
Check via McAfee interface or Windows registry: HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtectionVerify Fix Applied:
Verify McAfee Total Protection version is 16.0.30 or higher after update and restart.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion events in SYSTEM context
- Junction link creation/modification in McAfee directories
- Privilege escalation attempts
Network Indicators:
- Local system activity only - no network indicators
SIEM Query:
EventID=4663 AND ObjectName LIKE '%McAfee%' AND AccessMask=0x10000 AND SubjectUserName!=SYSTEM