McAfee EPolicy Orchestrator Framework Service Directory Traversal Vulnerability
BID:18979
CVE-2006-3623 |Info
McAfee EPolicy Orchestrator Framework Service Directory Traversal Vulnerability
| Bugtraq ID: | 18979 |
| Class: | Input Validation Error |
| CVE: |
CVE-2006-3623 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 14 2006 12:00AM |
| Updated: | Jun 26 2007 04:48PM |
| Credit: | McAfee and eEye Digital Security each independently discovered this vulnerability. |
| Vulnerable: |
McAfee ePolicy Orchestrator 3.5.5 McAfee ePolicy Orchestrator 3.0 SP2a McAfee ePolicy Orchestrator 3.0 McAfee ePolicy Orchestrator 2.5.1 McAfee ePolicy Orchestrator 2.5 SP1 McAfee ePolicy Orchestrator 2.5 McAfee ePolicy Orchestrator 2.0 McAfee ePolicy Orchestrator 1.1 McAfee ePolicy Orchestrator 1.0 McAfee ePolicy Orchestrator 3.5 |
| Not Vulnerable: |
McAfee ePolicy Orchestrator 3.6 McAfee ePolicy Orchestrator 3.5.5 .438 |
Discussion
McAfee EPolicy Orchestrator Framework Service Directory Traversal Vulnerability
The McAfee ePolicy Orchestrator framework service is prone to a directory-traversal vulnerability that can lead to complete system compromise..
The application fails to sanitize user input when accepting POST requests on the '/spipe/pkg' interface. Specifically, the script fails to sanitize input for proper directory and filename, allowing an attacker to conduct a directory-traversal attack that can overwrite existing files or place arbitrary files on a vulnerable computer.
A successful exploit may allow unauthorized remote users to overwrite existing files or place arbitrary files on a vulnerable computer.
The McAfee ePolicy Orchestrator framework service is prone to a directory-traversal vulnerability that can lead to complete system compromise..
The application fails to sanitize user input when accepting POST requests on the '/spipe/pkg' interface. Specifically, the script fails to sanitize input for proper directory and filename, allowing an attacker to conduct a directory-traversal attack that can overwrite existing files or place arbitrary files on a vulnerable computer.
A successful exploit may allow unauthorized remote users to overwrite existing files or place arbitrary files on a vulnerable computer.
Exploit / POC
McAfee EPolicy Orchestrator Framework Service Directory Traversal Vulnerability
An exploit is not required. An attacker could carry out this attack with available client applications.
An exploit is not required. An attacker could carry out this attack with available client applications.
Solution / Fix
McAfee EPolicy Orchestrator Framework Service Directory Traversal Vulnerability
Solution:
Customers must log onto the McAfee product update website and download version 3.5.5.438 of ePolicy Orchestrator or higher. ePolicy Orchestrator itself can also be used to upgrade this product to a reportedly non-vulnerable version.
Solution:
Customers must log onto the McAfee product update website and download version 3.5.5.438 of ePolicy Orchestrator or higher. ePolicy Orchestrator itself can also be used to upgrade this product to a reportedly non-vulnerable version.
References
McAfee EPolicy Orchestrator Framework Service Directory Traversal Vulnerability
References:
References:
- Vendor Customer Support Website (McAfee)
- Vendor Home Page (McAfee)