TI-2009-04865 Aliases CVE-2009-5118 GHSA-2fvm-hcc8-v9vr

Untrusted search path vulnerability in McAfee VirusScan Enterprise before 8.7i allows…

MEDIUM 43Published 2012-08-22 · Updated 2024-08-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: —
Confidentiality · integrity · availability: Complete · Complete · Complete
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Untrusted search path vulnerability in McAfee VirusScan Enterprise before 8.7i allows local users to gain privileges via a Trojan horse DLL in an unspecified directory, as demonstrated by scanning a document located on a remote share.

Why it matters now

EPSS 0.01615 76th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:mcafee:virusscan_enterprise::::::::	up to 8.5i	Vulnerable	McAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.0i:::::::*	8.0i	Vulnerable	McAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.0i:p11::::::	8.0i p11	Vulnerable	McAfee

cpe:2.3:a:mcafee:virusscan_enterprise:*:*:*:*:*:*:*:* Versions up to 8.5i Vulnerable ·McAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.0i:*:*:*:*:*:*:* Versions 8.0i Vulnerable ·McAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.0i:p11:*:*:*:*:*:* Versions 8.0i p11 Vulnerable ·McAfee

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2009-5118
2026-10-03 Alias added: GHSA-2fvm-hcc8-v9vr

References

Advisory 1

https://kc.mcafee.com/corporate/index?page=content&id=SB10013

TI-2016-06740 Improper authentication in Intel VirusScan Enterprise Linux CVSS 3.0HIGH 7.5
TI-2016-06738 Code injection in Intel VirusScan Enterprise Linux CVSS 3.0HIGH 8.0
TI-2016-06742 HTTP response splitting in Intel VirusScan Enterprise Linux CVSS 3.0HIGH 8.1
TI-2016-06741 Improper authentication in Intel VirusScan Enterprise Linux CVSS 3.0HIGH 8.1
TI-2007-02073 Buffer overflow in the On-Access Scanner in McAfee VirusScan Enterprise before 8.0i Patch… CVSS 2.0HIGH 7.9
TI-2020-05874 Privilege Escalation vulnerability through symbolic links in VSEL CVSS 3.1HIGH 8.8

See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences