McAfee UTM Firewall Appliance - Multiple Web Vulnerbilities

Document Title:
===============
McAfee UTM Firewall Appliance - Multiple Web Vulnerbilities


References (Source):
====================
MFE-UTM-20100429-01 - McAfee Unified Threat Management (UTM) Firewall Appliance - 6.8.6 build 6257


Release Date:
=============
2011-08-11


Vulnerability Laboratory ID (VL-ID):
====================================
72


Product & Service Introduction:
===============================
McAfee UTM Firewall is a complete office network-in-a-box Internet security appliance for small and medium-size businesses (SMBs). 
It features wide-area networking tools that you would normally only see with enterprise-class devices. Because the last thing SMBs 
need is another single-purpose security appliance to add to their network.

Use your UTM Firewall as your all-in-one solution to easily set up your business office with:

    * A local network of office PCs (wired or wireless, including DHCP and all LAN-routing functions)
    * Secure connectivity to the Internet with web-based content filtering
    * Seamless LAN to WAN connectivity with secure remote VPN access for your branch offices and mobile staff
    * A complete perimeter security solution, with options such as firewall, VPN, IDS/IPS, anti-spam, and content filtering

UTM Firewall handles it all for you, easily and affordably. It works by converging all networking, firewall, intrusion prevention 
security, and remote access requirements into one high-speed, highly reliable, small-form-factor appliance.
Just pick the UTM Firewall model that fits your business requirements and power it on. We have models ranging from our entry-level SOHO appliance, 
to our rack mount unit intended for larger offices. No additional routers, switches, DHCP servers, wireless devices, or failover devices are needed.
All UTM Firewalls can be centrally managed via the McAfee UTM Firewall Control Center. Centralized management is critical to larger distributed 
environments-it allows network administrators to manage hundreds or even thousands of UTM Firewall appliances with a click of the mouse, including 
upgrades, policy changes, and other configuration tasks.

(Copy of the Vendor Homepage: http://www.mcafee.com/us/enterprise/products/network_security/utm_firewall.html)


Abstract Advisory Information:
==============================
Vulnerability-Lab Team discovered multiple persistent Web Vulnerabilities on McAfee UTM Firewall Appliance.


Vulnerability Disclosure Timeline:
==================================
2011-08-12:	Public or Non-Public Disclosure


Discovery Status:
=================
Published


Affected Product(s):
====================

Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
1.1
Multiple Input Validation Vulnerabilities are detected on McAfee Unified Threat Management (UTM) Firewall Appliance.
A remote attacker can implement malicious persistent script codes to manipulate specific firewall application requests or content.

Vulnerable Module(s):
			                     [+] Diagnostics - Email System Log Delivery
			                     [+] View Local System Log
			                     [+] Debug Inseration
			                     [+] Display/Modify Device Configuration

1.2
A persistent bug is detected on the application exception-handling of the utm firewall appliance.
The errors got re-displayed & allows to execute persistent & non-persistent script codes.

Vulnerable Module(s):
			                     [+] McAfee Filter Exception-Handling	


Pictures:
			../1.png
			../2.png


Proof of Concept (PoC):
=======================
The vulnerabilities can be exploited local low privileged user accounts or remote attackers. For demonstration or reproduce ...

Code Review: Diagnostics - Email System Log Delivery

 <td class="label"><div class="error"><div class="label">Sender Email</div>
</div></td><td><input class="input" type="text" name="email.sender" value=">"<
INCLUDE OWN SCRIPTCODE HERE!>@localhost.com" size="24" maxlength="500"></td><td class="error">1</td>
</tr><tr class="stdelement"><td class="label"><div class="label">Filter Level</div></td><td><select name="filter">
<option value="debug" selected>Absolutely Everything</option>
<option value="info">Everything but Debug</option>
<option value="notice">Notices, Warnings and Errors</option>
<option value="warning">Errors and warnings</option>
<option value="err">All Error conditions</option>
<option value="crit">Emergency, Alerts and Critical Errors</option>
<option value="alert">Emergency and Alerts Errors</option>
<option value="emerg">Emergency Errors only</option>
</select>

Code Review: View Local System Log

<tr><td colspan="99"><div class="error_messages">Error Detected</div>
<p>The entered data could not be validated. The following diagnostics were generated: <ul> <li>
Failed validation on object syslog.target<1>: email.sender='>"<INCLUDE OWN SCRIPTCODE HERE!>@localhost.com'</li> </ul></p>
</td></tr><tr><td colspan="99" class="extable">Display/Modify Device Configuration</td></tr><tr>
<td><form name="set" action="/cgi-bin/cgix/debugconfig" method="post"><input type="hidden" name=".form" value="set">
<input type="hidden" name=".page" value="debugconfig"><input type="hidden" name=".session" value="705887099">
<input type="hidden" name="obj" value="syslog.target<1>"><input type="hidden" name="fieldname" value="email.sender">
<input class="default" type="image" name=".default" value="" width="0" height="0">


References:
http://192.168.2.137/cgi-bin/cgix/debugconfig?obj=syslog.target%3C1%3E;fieldname=email.sender#syslog.target%3C1%3E
http://192.168.2.137/cgi-bin/cgix/syslog_email
http://192.168.2.137/cgi-bin/cgix/syslog_local
http://192.168.2.137/cgi-bin/cgix/debugconfig


Security Risk:
==============
The security risk  of the persistent vulnerabilities are estimated as high(-) because they are all located on main modules.
The security risk of the non-persistent vulnerabilities are estimated as low.


Credits & Authors:
==================
Vulnerability Research Laboratory - Rem0ve


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.vulnerability-lab.com/register
Contact:    [email protected] 	- [email protected] 	       - [email protected]
Section:    video.vulnerability-lab.com 	- forum.vulnerability-lab.com 		       - news.vulnerability-lab.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.

    				   	Copyright © 2012 | Vulnerability Laboratory