McAfee E-Business Server Remote Preauth Code Execution / DoS

2008.01.10
Credit: Leon Juranic
Risk: High
Local: No
Remote: Yes
CWE: CWE-119


CVSS Base Score: 8.8/10
Impact Subscore: 9.2/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Complete
Availability impact: Complete

INFIGO IS Security Advisory #ADV-2008-01-06 http://www.infigo.hr/en/ Title: McAfee E-Business Server Remote Preauth Code Execution / DoS Advisory ID: INFIGO-2008-01-06 Date: 2008-01-09 Advisory URL: http://www.infigo.hr/en/in_focus/advisories/INFIGO-2008-01-06 Impact: Remote code execution Risk Level: High Vulnerability Type: Remote ==[ Overview McAfee E-Business Server guards sensitive corporate data with industry-standard PGP 128-bit encryption and authentication. McAfee E-Business Server supports a variety of platforms and security certificates. ==[ Vulnerability During an audit of McAfee E-Business Server, we have discovered a vulnerability in the administration interface (TCP port 1718). It is possible to crash McAfee E-Business Server during the authentication process. When a malformed (oversized) initial authentication packet is sent to E-Business Server, the server will crash, and will have to be manually restarted. A malformed authentication packet is shown below: "\x01\x3f\x2f\x05\x25\x2a" + "A" * 69953 McAfee further researched the vulnerability and confirmed that it allows an attacker to also remotely execute code. ==[ Affected Version The vulnerability has been identified in the latest available McAfee E-Business Server 8.5.2, and it was successfully tested on Windows and Linux platforms. Previous versions are believed to be vulnerable as well. ==[ Fix The vendor has addressed this vulnerability with E-Business server patch update on January 8th, 2008. Vendor advisory and update link: https://knowledge.mcafee.com/SupportSite/dynamickc.do?externalId=614472& sliceId=SAL_Public&command=show&forward=nonthreadedKC&kcId=614472 ==[ PoC Exploit http://www.infigo.hr/files/mcafee2.pl ==[ Vendor status 11.28.2007 - Initial contact 11.29.2007 - Initial vendor response 11.30.2007 - Vendor response 12.03.2007 - Vendor status update 12.10.2007 - Vendor status update 12.17.2007 - Vendor status update 01.07.2008 - Vendor status update 01.09.2008 - Coordinated public disclosure ==[ Credits Vulnerability discovered by Leon Juranic <leon.juranic (at) infigo (dot) hr [email concealed]>. ==[ INFIGO IS Security Contact INFIGO IS, WWW : http://www.infigo.hr/en/ E-mail : infocus (at) infigo (dot) hr [email concealed]


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top