Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Security App Flaws :: bx1354.htm

McAfee E-Business Server Remote Preauth Code Execution / DoS - Corrected



: McAfee E-Business Server Remote Preauth Code Execution / DoS - Corrected
: McAfee E-Business Server Remote Preauth Code Execution / DoS - Corrected





             INFIGO IS Security Advisory #ADV-2008-01-06
http://www.infigo.hr/en/ 



Title: McAfee E-Business Server Remote Preauth Code Execution / DoS
Advisory ID: INFIGO-2008-01-06
Date: 2008-01-09
Advisory URL: http://www.infigo.hr/en/in_focus/advisories/INFIGO-2008-01-06 
Impact: Remote code execution
Risk Level: High
Vulnerability Type: Remote




==[ Overview

McAfee E-Business Server guards sensitive corporate data with industry
-standard PGP 128-bit encryption and authentication. McAfee E-Business
Server supports a variety of platforms and security certificates.



==[ Vulnerability

During an audit of McAfee E-Business Server, we have discovered a
vulnerability in the administration interface (TCP port 1718).
It is possible to crash McAfee E-Business Server during the
authentication process.
When a malformed (oversized) initial authentication packet is sent to
E-Business Server, the server will crash, and will have to be manually
restarted.

A malformed authentication packet is shown below:
"\x01\x3f\x2f\x05\x25\x2a" + "A" * 69953

McAfee further researched the vulnerability and confirmed that it allows
an attacker to also remotely execute code.



==[ Affected Version

The vulnerability has been identified in the latest available McAfee
E-Business Server 8.5.2, and it was successfully tested on Windows and
Linux platforms. Previous versions are believed to be vulnerable as well.



==[ Fix

The vendor has addressed this vulnerability with E-Business server patch
update on January 8th, 2008.

Vendor advisory and update link:
https://knowledge.mcafee.com/SupportSite/dynamickc.do?externalId=614472&sliceId=SAL_Public&command=show&forward=nonthreadedKC&kcId=614472



==[ PoC Exploit

http://www.infigo.hr/files/mcafee2.pl 



==[ Vendor status

11.28.2007 - Initial contact
11.29.2007 - Initial vendor response
11.30.2007 - Vendor response
12.03.2007 - Vendor status update
12.10.2007 - Vendor status update
12.17.2007 - Vendor status update
01.07.2008 - Vendor status update
01.09.2008 - Coordinated public disclosure



==[ Credits

Vulnerability discovered by Leon Juranic . 



==[ INFIGO IS Security Contact

INFIGO IS,

WWW : http://www.infigo.hr/en/ 
E-mail : infocus@infigo.hr 



TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH