McAfee Virtual Technician MVT.MVTControl ActiveX Control Insecure Method

Added: 05/04/2012
BID: 53304


McAfee Virtual Technician is a free automated diagnosis and and problem resolution tool which scans a Windows system to ensure that McAfee products are installed correctly.


McAfee Virtual Technician ActiveX control (MVT.dll), as provided in McAfee Virtual Technician (and perhaps other versions), is vulnerable to remote code execution caused by an insecure GetObject method.


Contact the vendor to determine when the product has been patched. In the interim, the MVT.MVTControl ActiveX control in MVT.dll can be disabled by following Microsoft's instructions at to disable clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF.



This exploit has been tested against McAfee Virtual Technician on Microsoft Windows XP SP3 English (DEP OptIn) and Microsoft Windows 7 SP1 (DEP OptIn).

The exploit page must be opened using Internet Explorer 8 or 9 on the target.



Back to exploit index