Vulnerability CVE-2008-1357
Published: 2008-03-17   Modified: 2012-02-12

Description:
Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8.

See advisories in our WLB2 database:
Topic
Author
Date
High
Format string in McAfee Framework 3.6.0.569 (ePolicy Orchestrator 4.0)
Luigi Auriemma
17.03.2008

Type:

CWE-134

 (Uncontrolled Format String)

CVSS2 => (AV:N/AC:H/Au:N/C:N/I:N/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.4/10
6.9/10
4.9/10
Exploit range
Attack complexity
Authentication
Remote
High
No required
Confidentiality impact
Integrity impact
Availability impact
None
None
Complete
Affected software
Mcafee -> Agent 
Mcafee -> CMA 
Mcafee -> Epolicy orchestrator 
Mcafee -> Mcafee framework 

 References:
http://aluigi.altervista.org/adv/meccaffi-adv.txt
http://securityreason.com/securityalert/3748
http://www.securityfocus.com/archive/1/489476/100/0/threaded
http://www.securityfocus.com/bid/28228
http://www.securitytracker.com/id?1019609
http://www.vupen.com/english/advisories/2008/0866/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/41178
https://knowledge.mcafee.com/article/234/615103_f.sal_public.html
Copyright 2024, cxsecurity.com

 

Back to Top