CVE-2003-0149

CVE-2003-0149: ePolicy Orchestrator (McAfee) with Agent 2.0/2.5/2.5.1 is affected by a Heap Overflow in the Agent. A remote attacker can trigger arbitrary code execution by sending a POST request with long parameters to the Agent. The issue is documented alongside other ePO vulnerabilities; a ven...

CVE-2003-0148

The CVE-2003-0148 entry concerns a vulnerability in the default MSDE installation used with McAfee ePolicy Orchestrator (ePO) 2.0–3.0. The issue allows an attacker who can access the ePO server to obtain the database administrator username and the encrypted password from the server config file. T...

ePolicy Orchestrator multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: ePolicy Orchestrator multiple vulnerabilities Release Date: 07/31/2003 Application: McAfee ePolicy Orchestrator 2.X and 3.0 Platform: Windows Severity: Remote code execution Author: Andreas...

Multiple McAfee ePolicy Orchestrator bugs

Buffer overflows, format string bugs, MSDE is installed in insecure configuration...

CVE-2002-0690

Format string vulnerability in McAfee Security ePolicy Orchestrator ePO 2.5.1 allows remote attackers to execute arbitrary code via an HTTP GET request with a URI containing format strings...

CVE-2000-0502

Mcafee VirusScan 4.03 does not properly restrict access to the alert text file before it is sent to the Central Alert Server, which allows local users to modify alerts in an arbitrary fashion...

CVE-2000-0502

Mcafee VirusScan 4.03 is affected by a local-access restriction flaw in the alert text file before it is sent to the Central Alert Server, allowing local users to modify alerts and impact the integrity of alert data. The root cause is improper access restriction of the alert file, enabling unauth...

CVE-2002-0690

McAfee Security ePolicy Orchestrator (ePO) 2.5.1 is affected by CVE-2002-0690, a format-string vulnerability in the HTTP GET request path that can allow remote code execution with SYSTEM privileges. The issue stems from processing of network requests (port 8081) and can enable arbitrary code exec...

CVE-2002-0690

Format string vulnerability in McAfee Security ePolicy Orchestrator ePO 2.5.1 allows remote attackers to execute arbitrary code via an HTTP GET request with a URI containing format strings...

McAfee ePolicy Orchestrator Format String Vulnerability (a031703-1)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: ePolicy Orchestrator Format String Vulnerability Release Date: 03/17/2003 Application: McAfee ePolicy Orchestrator 2.5.1 Platform: Windows 2000 Server SP1 Windows 2000 Pro SP1 Severity: The...

McAfee ePolicy Orchestrator format string bug

Format string bug during network request processing...

CVE-2002-2282

McAfee VirusScan 4.5.1, when the WebScanX.exe module is enabled, searches for particular DLLs from the user's home directory, even when browsing the local hard drive, which allows local users to run arbitrary code via malicious versions of those DLLs...

CVE-2001-1144

Directory traversal vulnerability in McAfee ASaP VirusScan agent 1.0 allows remote attackers to read arbitrary files via a .. dot dot in the HTTP request...

CVE-2001-1144

CVE-2001-1144 affects McAfee ASaP VirusScan agent 1.0, exposing a directory traversal vulnerability in the HTTP server that allows remote attackers to read arbitrary files via …/ in requests. Exploitation details in connected docs indicate the vulnerable component is the VirusScan ASaP HTTP servi...

CVE-2001-0612

McAfee Remote Desktop 3.0 and earlier allows remote attackers to cause a denial of service crash via a large number of packets to port 5045...

McAfee ASaP VirusScan service does not adequately validate input

Overview A vulnerability exists in McAfee ASaP VirusScan that permits intruders to access files outside of the web root. Description Quoting from the McAfee ASaP VirusScan FAQ, McAfee ASaP VirusScan is "a web-based, managed and updated anti-virus service for the entire desktop environment." McAfe...

mcaffee.mycio.traversal.txt

----- Begin Hush Signed Message from [email protected] ----- -= SECURITY ADVISORY =- McAfee ASaP Virusscan - myCIO HTTP Server Directory Traversal Vulnerabilty Date: 28 June 2001 Impact: HIGH Affected: Any machine running the McAfee Agent ASaP VirusScan Software Tested on: NT Workstation 4.0,...

CVE-2001-1144

Directory traversal vulnerability in McAfee ASaP VirusScan agent 1.0 allows remote attackers to read arbitrary files via a .. dot dot in the HTTP request...

Remote Desktop DoS

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Remote Desktop 3.0 and previous DoS Affected: Win95/95/ME running Mcafee Remote Desktop 3.0 and below Problem: possible for remote attacker to crash Remote Desktop session. in some cases crashing the remote desktop agent. Desc: Remote desktop agent...

CVE-2000-1128

The default configuration of McAfee VirusScan 4.5 does not quote the ImagePath variable, which improperly sets the search path and allows local users to place a Trojan horse "common.exe" program in the C:\Program Files directory...