McAfee E-Business Server Remote Preauth Code Execution / DoS

Credit: Leon Juranic
Risk: High
Local: No
Remote: Yes
CWE: CWE-119

CVSS Base Score: 8.8/10
Impact Subscore: 9.2/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Complete
Availability impact: Complete

INFIGO IS Security Advisory #ADV-2008-01-06 Title: McAfee E-Business Server Remote Preauth Code Execution / DoS Advisory ID: INFIGO-2008-01-06 Date: 2008-01-09 Advisory URL: Impact: Remote code execution Risk Level: High Vulnerability Type: Remote ==[ Overview McAfee E-Business Server guards sensitive corporate data with industry-standard PGP 128-bit encryption and authentication. McAfee E-Business Server supports a variety of platforms and security certificates. ==[ Vulnerability During an audit of McAfee E-Business Server, we have discovered a vulnerability in the administration interface (TCP port 1718). It is possible to crash McAfee E-Business Server during the authentication process. When a malformed (oversized) initial authentication packet is sent to E-Business Server, the server will crash, and will have to be manually restarted. A malformed authentication packet is shown below: "\x01\x3f\x2f\x05\x25\x2a" + "A" * 69953 McAfee further researched the vulnerability and confirmed that it allows an attacker to also remotely execute code. ==[ Affected Version The vulnerability has been identified in the latest available McAfee E-Business Server 8.5.2, and it was successfully tested on Windows and Linux platforms. Previous versions are believed to be vulnerable as well. ==[ Fix The vendor has addressed this vulnerability with E-Business server patch update on January 8th, 2008. Vendor advisory and update link: sliceId=SAL_Public&command=show&forward=nonthreadedKC&kcId=614472 ==[ PoC Exploit ==[ Vendor status 11.28.2007 - Initial contact 11.29.2007 - Initial vendor response 11.30.2007 - Vendor response 12.03.2007 - Vendor status update 12.10.2007 - Vendor status update 12.17.2007 - Vendor status update 01.07.2008 - Vendor status update 01.09.2008 - Coordinated public disclosure ==[ Credits Vulnerability discovered by Leon Juranic <leon.juranic (at) infigo (dot) hr [email concealed]>. ==[ INFIGO IS Security Contact INFIGO IS, WWW : E-mail : infocus (at) infigo (dot) hr [email concealed]

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022,


Back to Top