McAfee Managed Agent contains a denial-of-service (DoS) vulnerability

Overview

McAfee Managed Agent versions 4.5, 4.6, and possibly earlier versions contain a denial-of-service (DoS) vulnerability (CWE-400).

Description

CWE-400:Uncontrolled Resource Consumption (‘Resource Exhaustion’)

McAfee Managed Agent versions 4.5 and 4.6 contain a denial-of-service (DoS) vulnerability. McAfee Managed Agent runs a service on Windows workstations called “McAfee Framework Service” (FrameworkService.exe) which runs an HTTP server on the default TCP port 8081.

By sending a crafted request an attacker can remotely crash the Windows service. This can cause the McAfee software to temporarily stop updating or provide log data until the service is manually restarted.

---

Impact

An unauthenticated remote attacker may be able to cause a denial-of-service against the McAfee Managed Agent software.

---

Solution

McAfee has released a security bulletin with the details on obtaining the security hotfix for Managed Agent 4.5 Patch 3 and Managed Agent 4.6 Patch 3. McAfee Managed Agent versions 4.8 RTW and later are not affected. If applying the security hotfix is not possible, please consider the following workaround.

---

Accept connections only from the ePO server
Make sure that the “Accept connections only from the ePO server” option is enabled in the ePO Agent policy.

---

Vendor Information

613886

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

McAfee Affected

Notified: September 04, 2013 Updated: October 03, 2013

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• https://kc.mcafee.com/corporate/index?page=content&id=SB10055

CVSS Metrics

Group	Score	Vector
Base	5	AV:N/AC:L/Au:N/C:N/I:N/A:P
Temporal	3.9	E:POC/RL:OF/RC:C
Environmental	2.9	CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

• <http://cwe.mitre.org/data/definitions/400.html&gt;
• https://kc.mcafee.com/corporate/index?page=content&id=SB10055

Acknowledgements

Thanks to Rodney Beede for reporting this vulnerability.

This document was written by Adam Rauf.

Other Information

CVE IDs:	CVE-2013-3627
Date Public:	2013-10-01 Date First Published: