McAfee Common Management Agent (CMA) Multiple Memory Corruption Vulnerabilities

Bugtraq ID:	24863
Class:	Boundary Condition Error
CVE:	CVE-2006-5271 CVE-2006-5272 CVE-2006-5273 CVE-2006-5274
Remote:	Yes
Local:	No
Published:	Jul 11 2007 12:00AM
Updated:	Jul 11 2007 10:27PM
Credit:	Neel Mehta, a researcher for IBM ISS X-Force, is credited with the discovery of these issues.
Vulnerable:	McAfee ProtectionPilot 1.5 McAfee ProtectionPilot 1.1.1 McAfee ePolicy Orchestrator 3.6.1 McAfee ePolicy Orchestrator 3.6 McAfee ePolicy Orchestrator 3.5 McAfee Common Management Agent (CMA) 3.6 .453 McAfee Common Management Agent (CMA) 3.6 .438 McAfee Common Management Agent (CMA) 3.5.5 .438 McAfee Common Management Agent (CMA) 3.0.6 .453
Not Vulnerable:	McAfee Common Management Agent (CMA) 3.6 .546

McAfee Common Management Agent (CMA) Multiple Memory Corruption Vulnerabilities

McAfee Common Management Agent is prone to mutiple memory-corruption vulnerabilities. The application fails to properly bounds-check user-supplied data in several instances before copying it into insufficiently sized memory buffers.

A remote attacker may exploit these issues to execute arbitrary code on a vulnerable computer with SYSTEM privileges. Failed exploit attempts may result in denial-of-service conditions.

Various versions of CMA are affected by these issues. CMA is also included with ePolicy Orchestrator and ProtectionPilot.

McAfee Common Management Agent (CMA) Multiple Memory Corruption Vulnerabilities

Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

McAfee Common Management Agent (CMA) Multiple Memory Corruption Vulnerabilities

Solution:
The vendor has released advisories and fixes to address these issues. Please see the references for details.


McAfee Common Management Agent (CMA) 3.0.6 .453

• McAfee Common Management Agent 3.6.0 Patch 1 (CMA3.6.0.546)
  https://mysupport.mcafee.com/eservice_enu/start.swe

McAfee Common Management Agent (CMA) 3.5.5 .438

• McAfee Common Management Agent 3.6.0 Patch 1 (CMA3.6.0.546)
  https://mysupport.mcafee.com/eservice_enu/start.swe

McAfee Common Management Agent (CMA) 3.6 .438

• McAfee Common Management Agent 3.6.0 Patch 1 (CMA3.6.0.546)
  https://mysupport.mcafee.com/eservice_enu/start.swe

McAfee Common Management Agent (CMA) 3.6 .453

• McAfee Common Management Agent 3.6.0 Patch 1 (CMA3.6.0.546)
  https://mysupport.mcafee.com/eservice_enu/start.swe

McAfee Common Management Agent (CMA) Multiple Memory Corruption Vulnerabilities

References:

• ePolicy Orchestrator Product Page (McAfee)
  
• ProtectionPilot Product Page (McAfee)
  
• McAfee ePolicy Orchestrator Agent Remote Code Execution (ISS)
  
• McAfee Security Bulletin - Crash of Framework service of McAfee Common Managemen (McAfee)
  
• McAfee Security Bulletin - Heap based buffer overflow of Common Management Agent (McAfee)
  
• McAfee Security Bulletin - Stack based buffer overflow of Common Management Agen (McAfee)
  
• McAfee Security Bulletin - Stack corruption of Common Management Agent (CMA) (McAfee)