INFIGO IS Security Advisory #ADV-2008-01-06
Title: McAfee E-Business Server Remote Preauth Code Execution / DoS
Advisory ID: INFIGO-2008-01-06
Advisory URL: http://www.infigo.hr/en/in_focus/advisories/INFIGO-2008-01-06
Impact: Remote code execution
Risk Level: High
Vulnerability Type: Remote
McAfee E-Business Server guards sensitive corporate data with
PGP 128-bit encryption and authentication. McAfee E-Business Server supports
variety of platforms and security certificates.
During an audit of McAfee E-Business Server, we have discovered a
in the administration interface (TCP port 1718).
It is possible to crash McAfee E-Business Server during the authentication
When a malformed (oversized) initial authentication packet is sent to
the server will crash, and will have to be manually restarted.
A malformed authentication packet is shown below:
"\x01\x3f\x2f\x05\x25\x2a" + "A" * 69953
McAfee further researched the vulnerability and confirmed that it allows an
to also remotely execute code.
==[ Affected Version
The vulnerability has been identified in the latest available McAfee
E-Business Server 8.5.2, and it was successfully tested on Windows and Linux
Previous versions are believed to be vulnerable as well.
The vendor has addressed this vulnerability with E-Business server patch
on January 8th, 2008.
Vendor advisory and update link:
==[ PoC Exploit
==[ Vendor status
11.28.2007 - Initial contact
11.29.2007 - Initial vendor response
11.30.2007 - Vendor response
12.03.2007 - Vendor status update
12.10.2007 - Vendor status update
12.17.2007 - Vendor status update
01.07.2008 - Vendor status update
01.09.2008 - Coordinated public disclosure
Vulnerability discovered by Leon Juranic <leon.juranic (at) infigo (dot) hr [email concealed]>.
==[ INFIGO IS Security Contact
WWW : http://www.infigo.hr/en/
E-mail : infocus (at) infigo (dot) hr [email concealed]