The remote host has a version of McAfee VirusScan Enterprise for Linux (VSEL) installed that is prior or equal to 2.0.3. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     web interface due to improper error reporting. An     authenticated, remote attacker can exploit this, by     manipulating the 'tplt' parameter, to disclose filenames     on the system. (CVE-2016-8016)

  - An information disclosure vulnerability exists in the     parser due to improper handling of template files. An     authenticated, remote attacker can exploit this, via     specially crafted text elements, to disclose the     contents of arbitrary files subject to the privileges of     the 'nails' account. (CVE-2016-8017)

  - Multiple cross-site request forgery (XSRF)     vulnerabilities exist in the web interface due to a     failure to require multiple steps, explicit     confirmation, or a unique token when performing certain     sensitive actions. An unauthenticated, remote attacker     can exploit these vulnerabilities, by convincing a user     to follow a specially crafted link, to execute arbitrary     script code or commands in a user's browser session.
    (CVE-2016-8018)

  - Multiple cross-site scripting (XSS) vulnerabilities     exist due to improper validation of user-supplied input     to the 'info:7' and 'info:5' parameters when the 'tplt'     parameter is set in NailsConfig.html or     MonitorHost.html. An unauthenticated, remote attacker     can exploit these vulnerabilities, via a specially     crafted request, to execute arbitrary script code in a     user's browser session. (CVE-2016-8019)

  - A remote code execution vulnerability exists due to     improper validation of user-supplied input to the     'nailsd.profile.ODS_9.scannerPath' variable in the last     page of the system scan form. An authenticated, remote     attacker can exploit this, via a specially crafted HTTP     request, to execute arbitrary code as the root user.
    (CVE-2016-8020)

  - A remote code execution vulnerability exists in the web     interface when downloading update files from a specified     update server due to a race condition. An authenticated,     remote attacker can exploit this to place and execute a     downloaded file before integrity checks are completed.
    (CVE-2016-8021)

  - A security bypass vulnerability exists in the web     interface due to improper handling of authentication     cookies. The authentication cookie stores the IP address     of the client and is checked to ensure it matches the     IP address of the client sending it; however, an     unauthenticated, remote attacker can cause the cookie to     be incorrectly parsed by adding a number of spaces to     the IP address stored within the cookie, resulting in a     bypass of the security mechanism. (CVE-2016-8022)

  - A security bypass vulnerability exists in the web     interface due to improper handling of the nailsSessionId     authentication cookie. An unauthenticated, remote     attacker can exploit this, by brute-force guessing the     server start authentication token within the cookie, to     bypass authentication mechanisms. (CVE-2016-8023)

  - An HTTP response splitting vulnerability exists due to     improper sanitization of carriage return and line feed     (CRLF) character sequences passed to the 'info:0'     parameter before being included in HTTP responses. An     authenticated, remote attacker can exploit this to     inject additional headers in responses and disclose     sensitive information. (CVE-2016-8024)

  - A SQL injection (SQLi) vulnerability exists in the web     interface due to improper sanitization of user-supplied     input to the 'mon:0' parameter. An authenticated, remote     attacker can exploit this to inject or manipulate SQL     queries in the back-end database, resulting in the     manipulation or disclosure of arbitrary data.
    (CVE-2016-8025)

Detections

Analytics

McAfee VirusScan Enterprise for Linux <= 2.0.3 Multiple vulnerabilities (SB10181)

critical Nessus Plugin ID 95812

Version 1.15

Version 1.14

Version 1.15 Feb 18, 2025, 11:54 PM Plugin metadata (CVSS 3 Change AC:H --> AC:L where needed) Plugin Feed: 202502182354
Version 1.14 Jul 24, 2024, 6:31 PM Logic Changes (Modernize SSH usage to optimize behavior on Nessus Agents.. adding AI family) Plugin Feed: 202407241831