CVE-2017-3897

This vulnerability is like a “software trick” where an attacker may be able to get your McAfee product to run unexpected malicious code. Think of it as sending a forged message that causes the program to do something it wasn’t supposed to do. If it’s reachable and the vulnerable version is used, that can lead to device compromise and service disruption.

This matters if your business runs McAfee Live Safe or McAfee Security Scan Plus (MSS+) versions older than the fixed releases. The risk is network-based, meaning an attacker doesn’t need to log in to try the attack. Apply the update if the vulnerable software is exposed/reachable from the network in your environment (for example, reachable services or network paths that accept the HTTP backend response involved in the authentication flow).

Treat this as urgent-but-not-emergency: it’s been getting increased press attention, and the bug is designed for remote network attackers without a log-in. However, the provided findings do not show confirmed exploitation in the wild or public exploit code, so the most appropriate response is to upgrade promptly and methodically (the “amber” level).

1. Confirm installation and versions

• On each affected endpoint, open the product details for McAfee Live Safe and McAfee Security Scan Plus (MSS+).
• Record the exact installed version.

2. Determine whether you’re in the vulnerable range

• McAfee Live Safe: vulnerable if the installed version is prior to 16.0.3.
• McAfee Security Scan Plus (MSS+): vulnerable if the installed version is prior to 3.11.599.3.

3. Upgrade to the fixed versions

• Upgrade Live Safe to 16.0.3 or later.
• Upgrade Security Scan Plus (MSS+) to 3.11.599.3 or later.
• After upgrading, verify the reported version matches the fixed release.

4. If patching is delayed (temporary containment)

• Restrict inbound network access to the affected machines and reduce external exposure of any services that might participate in the HTTP authentication/backend flow.
• If your environment uses a firewall/segmentation policy, ensure only required traffic is allowed.

5. Validate and monitor

• Confirm the McAfee product is fully functional after upgrade.
• Watch for unexpected alerts related to authentication failures or suspicious network activity around the product’s HTTP communication paths, and ensure logs are reviewed during the change window.

CISA KEV

• CVE-2017-3897 is not listed in the provided CISA KEV data, so follow-up checks should focus on your own exposure (installed version + network reachability), not just external tracking.

Due date

• No CISA due date was provided in the findings.

CVE-2017-3897 is a code injection vulnerability (CWE-94) affecting the non-certificate-based authentication mechanism in McAfee Live Safe and McAfee Security Scan Plus (MSS+). The described mechanism is that a remote attacker can use an HTTP backend response to trigger malicious file execution. The provided findings do not list the CVE in CISA KEV, and there is no public exploit code on record; exploitation status in the provided material is therefore not confirmed. The findings indicate rising press attention, but the overall exploitation evidence is not established.

What KEV means here

• KEV listing typically indicates known, widespread exploitation. Since KEV is not listed in the provided findings, you should base urgency primarily on whether you run vulnerable versions and whether the vulnerable authentication flow is reachable from the network in your environment.

Exploit maturity (from findings)

• No public exploit code is recorded in the provided findings, suggesting limited public weaponization at the time of those sources.