Search...

McAfee Firewall Reporter isValidClient Authentication Bypass

2011-06-03T00:00:00

ID SAINT:AAAF3B572D61CB75E2DD5CB0065C770F
Type saint
Reporter SAINT Corporation
Modified 2011-06-03T00:00:00

Description

Added: 06/03/2011
BID: 47306
OSVDB: 71842

Background

McAfee Firewall Reporter is an enterprise-class security event management (SEM) reporting solution.

Problem

McAfee Firewall Reporter versions 5.1.0.6 through 5.1.0.12 are vulnerable to an authentication bypass that may allow remote attackers to upload files to the server. This may allow attackers to upload and execute arbitrary code.

Resolution

Upgrade to McAfee Firewall Reporter version 5.1.0.13 or later.

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10015
<http://www.zerodayinitiative.com/advisories/ZDI-11-117/>
<http://secunia.com/advisories/44110/>

Limitations

This exploit has been tested against McAfee Firewall Reporter 5.1.0.6 on Windows Server 2003 SP2 English (DEP OptOut) and Windows Server 2008 SP2 (DEP OptOut).
The exploit creates two files on the server which persist after the shell connection is terminated: c:\exploit.exe and /cgi-bin/exploit.cgi. These files should be removed manually after successful exploitation.

Platforms

Windows

JSON Vulners Source

Initial Source

{"enchantments": {"score": {"value": 2.3, "vector": "NONE", "modified": "2016-10-03T15:01:56", "rev": 2}, "dependencies": {"references": [], "modified": "2016-10-03T15:01:56", "rev": 2}, "vulnersScore": 2.3}, "reporter": "SAINT Corporation", "id": "SAINT:AAAF3B572D61CB75E2DD5CB0065C770F", "cvss": {"score": 0.0, "vector": "NONE"}, "published": "2011-06-03T00:00:00", "bulletinFamily": "exploit", "viewCount": 4, "modified": "2011-06-03T00:00:00", "references": [], "cvelist": [], "description": "Added: 06/03/2011 \nBID: [47306](<http://www.securityfocus.com/bid/47306>) \nOSVDB: [71842](<http://www.osvdb.org/71842>) \n\n\n### Background\n\nMcAfee Firewall Reporter is an enterprise-class security event management (SEM) reporting solution. \n\n### Problem\n\nMcAfee Firewall Reporter versions 5.1.0.6 through 5.1.0.12 are vulnerable to an authentication bypass that may allow remote attackers to upload files to the server. This may allow attackers to upload and execute arbitrary code. \n\n### Resolution\n\nUpgrade to McAfee Firewall Reporter version 5.1.0.13 or later. \n\n### References\n\n[https://kc.mcafee.com/corporate/index?page=content&id=SB10015 ](<https://kc.mcafee.com/corporate/index?page=content&id=SB10015\n>) \n<http://www.zerodayinitiative.com/advisories/ZDI-11-117/> \n<http://secunia.com/advisories/44110/> \n\n\n### Limitations\n\nThis exploit has been tested against McAfee Firewall Reporter 5.1.0.6 on Windows Server 2003 SP2 English (DEP OptOut) and Windows Server 2008 SP2 (DEP OptOut). \nThe exploit creates two files on the server which persist after the shell connection is terminated: c:\\exploit.exe and /cgi-bin/exploit.cgi. These files should be removed manually after successful exploitation. \n\n### Platforms\n\nWindows \n \n\n", "type": "saint", "href": "http://www.saintcorporation.com/cgi-bin/exploit_info/mcafee_firewall_reporter_isvalidclient", "lastseen": "2016-10-03T15:01:56", "edition": 1, "title": "McAfee Firewall Reporter isValidClient Authentication Bypass"}