cve/2018/CVE-2018-6693.md

### [CVE-2018-6693](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6693)
![](https://img.shields.io/static/v1?label=Product&message=%20Endpoint%20Security%20for%20Linux%20Threat%20Prevention%20(ENSLTP)&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=10.5.010.5.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Privilege%20Escalation%20(CWE-274)&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Race%20Condition%20Enabling%20Link%20Following%20(CWE-363)&color=brighgreen)

### Description

An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escalation to delete arbitrary files.

### POC

#### Reference
- https://kc.mcafee.com/corporate/index?page=content&id=SB10248
- https://kc.mcafee.com/corporate/index?page=content&id=SB10248

#### Github
No PoCs found on GitHub currently.