CVE-2020-7267: 
McAfee VirusScan Enterprise vulnerability analysis and mitigation

A privilege escalation vulnerability identified as CVE-2020-7267 was discovered in McAfee VirusScan Enterprise (VSE) for Linux versions prior to 2.0.3 Hotfix 2635000. The vulnerability was published on May 8, 2020, and affects McAfee's endpoint security products (Rapid7).

The vulnerability allows local users to delete files they would normally not have access to by manipulating symbolic links to redirect McAfee delete actions to unintended files. This can be accomplished through the execution of a malicious script or program on the target machine. The vulnerability has been assigned a CVSS score of 4.0, indicating moderate severity, with the vector string AV:L/AC:L/Au:N/C:N/I:P/A:P (Rapid7).

The vulnerability enables unauthorized file deletion, potentially allowing attackers to remove critical system files or data that they would normally not have permission to access. This could lead to system instability or loss of important data (Rapid7).

The vulnerability requires local access to the affected system and the ability to execute malicious scripts or programs. The attack complexity is considered low, requiring no authentication for exploitation (Rapid7).

McAfee has released several updates to address this vulnerability, including upgrades to versions 10.5.5.5358, 10.6.1.1963, and 10.7.0.1733 of the Endpoint Security Platform. Users are advised to upgrade to these patched versions to mitigate the vulnerability (Rapid7).