The vulnerable agent in question is used in enterprise-wide installations to push updates and signatures down to managed AV clients. This will typically include all desktops and servers in most McAfee’s AV customer’s enterprise environments. This agent is not typically used in any consumer installation of the software, and is generally specific to the enterprise. However, deployment is generally very widespread in environments where it is used.

McAfee’s ePO package format is used to deliver messages to agents over several different vectors. These packages can be delivered by a pseudo-web server running on a configurable port, or via a configurable UDP listener.

McAfee e-Policy Orchestrator Agent has the following vulnerabilities

• An integer underflow, caused by improper bounds checking, which could lead to memory corruption.  An attacker could exploit this vulnerability to execute arbitrary code on the system.

•  A stack-based buffer overflow, caused by improper bounds checking of pings. By sending a specially-crafted packet, a remote attacker could overflow a buffer and execute arbitrary code on the system.

• A heap-based buffer overflow, caused by improper bounds checking. By sending a specially-crafted packet, a remote attacker could overflow a buffer and execute arbitrary code on the system.

• An integer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system.

McAfee has released patches for these issues.  See References for details.