XML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a local user to initiate high CPU and memory consumption resulting in a Denial of Service attack through carefully editing the EPDeploy.xml file and then executing the setup process.
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Endpoint_security | Mcafee | * | 10.7.0 (excluding) |
| Endpoint_security | Mcafee | 10.7.0-april_2020 (including) | 10.7.0-april_2020 (including) |
| Endpoint_security | Mcafee | 10.7.0-april_2021 (including) | 10.7.0-april_2021 (including) |
| Endpoint_security | Mcafee | 10.7.0-february_2020 (including) | 10.7.0-february_2020 (including) |
| Endpoint_security | Mcafee | 10.7.0-february_2021 (including) | 10.7.0-february_2021 (including) |
| Endpoint_security | Mcafee | 10.7.0-july_2020 (including) | 10.7.0-july_2020 (including) |
| Endpoint_security | Mcafee | 10.7.0-june_2021 (including) | 10.7.0-june_2021 (including) |
| Endpoint_security | Mcafee | 10.7.0-november_2020 (including) | 10.7.0-november_2020 (including) |
| Endpoint_security | Mcafee | 10.7.0-september_2020 (including) | 10.7.0-september_2020 (including) |